I noticed that ZDI-10-118 and ZDI-10-123 both reference CVE-2010-0904. The CVE entry only says "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors." and links to Oracle's CPU for July 2010. Is one ZDI advisory more "correct" for this CVE? George -- theall at tenablesecurity.com