CVE-2002-1637

Multiple components in Oracle 9i Application Server 9iAS are installed with over 160 default usernames and passwords, including 1 SYS, 2 SYSTEM, 3 AQJAVA, 4 OWA, 5 IMAGEUSER, 6 USER1, 7 USER2, 8 PLSQL, 9 DEMO, 10 FINANCE, and many others, which allows attackers to gain privileges...

CVE-2001-1372

Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message...

CVE-2001-1217

Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. dot dot sequences...

CVE-2001-1216

Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page...

oracle.9i.path.txt

Product: Oracle 9i Application Server. Description: The Oracle 9i Application Server uses the Apache web server for HTTP service. However, if a request is made for a non-existent .jsp file, the complete path is shown. For instance, if you were to make the following request at a server running...

CVE-2001-0516

CVE-2001-0516 affects the Oracle listener (Oracle 9i and 8.0-era setups). The vulnerability is triggered by a malformed connection packet containing an incorrect requester_version value, causing the listener to crash and enabling a remote denial of service. It is one of four related issues descri...

CVE-2001-0516: Undefined Security Weakness

Oracle listener between Oracle 9i and Oracle 8.0 allows remote attackers to cause a denial of service via a malformed connection packet that contains an incorrect requesterversion value that does not match an expected offset to the data...