Oracle 9i Application Server OWA UTIL Accessible - Active Check

Oracle 9i Application Server AS can provide access to the PL/SQL application OWAUTIL that provides web access to some stored procedures. SPDX-FileCopyrightText: 2003 Javier Fernandez-Sanguino Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

Oracle 9i Application Server mod_plsql Buffer Overflow Vulnerability - Active Check

Oracle 9i Application Server AS uses Apache as it SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:applicationserver";...

Oracle 9i Application Server Dynamic Monitoring Services Accessible - Active Check

In a default installation of Oracle 9i Application Server AS, it is possible to access the Dynamic Monitoring Services pages anonymously. Access to these pages should be restricted. SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and ar...

CVE-2005-2093

Oracle 9i Application Server Oracle9iAS 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to...

CVE-2005-2093

Oracle 9i Application Server Oracle9iAS 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to...

CVE-2004-1877

The psubmiturl value in the sample login form in the Oracle 9i Application Server 9iAS Single Sign-on Administrators Guide, Release 29.0.2 for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password...

CVE-2002-1635

The Apache configuration file httpd.conf in Oracle 9i Application Server 9iAS uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin...

CVE-2002-1637

Multiple components in Oracle 9i Application Server 9iAS are installed with over 160 default usernames and passwords, including 1 SYS, 2 SYSTEM, 3 AQJAVA, 4 OWA, 5 IMAGEUSER, 6 USER1, 7 USER2, 8 PLSQL, 9 DEMO, 10 FINANCE, and many others, which allows attackers to gain privileges...

CVE-2002-1632

Oracle 9i Application Server 9iAS installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via 1 info.jsp, 2 printenv, 3 echo, or 4 echo2...

CVE-2002-1631

SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server 9iAS allows remote attackers to execute arbitrary code via the sql parameter...

CVE-2002-1630

The sendmail.jsp sample page in Oracle 9i Application Server 9iAS allows remote attackers to send arbitrary emails...

CVE-2002-1631

CVE-2002-1631 corresponds to a SQL injection vulnerability in the query.xsql sample page of Oracle 9i Application Server (9iAS). The affected component is the query.xsql page within the Oracle XSQL/9iAS environment, and the underlying root cause is unsafely handling the sql parameter in the page,...

Oracle 9iAS SOAP Default Configuration Unauthenticated Application Deployment

Binary data 1593.prm...

Oracle 9iAS Administrative Web Interface Authentication Weakness

Binary data 1894.prm...

Oracle 9iAS .JSP File Request Default Error Information Disclosure

Binary data 1594.prm...

Oracle 9iAS iSQLplus XSS

The remote host is running a version of the Oracle9i 'isqlplus' CGI that is vulnerable to a cross-site scripting attack. An attacker may exploit this flaw to steal the cookies of legitimate users on the remote host. %NASLMINLEVEL 70300 This script was written by Frank Berger This vulnerability wa...

Oracle 9iAS PL/SQL Gateway Web Admin Interface Null Authentication

Oracle 9i Application Server uses Apache as its web server with an Apache module for PL/SQL support. By default, no authentication is required to access the DAD configuration page. An attacker may use this flaw to modify PL/SQL applications or prevent the remote host from working properly...

Oracle 9iAS Nonexistent .jsp File Request Error Message Path Disclosure

Oracle 9iAS allows remote attackers to obtain the physical path of a file under the server root via a request for a nonexistent .JSP file. The default error generated leaks the pathname in an error message. %NASLMINLEVEL 70300 This script was written by Javier Fernandez-Sanguino This software is...

Oracle 9iAS Default SOAP Configuration Unauthorized Application Deployment

In a default installation of Oracle 9iAS v.1.0.2.2, it is possible to deploy or undeploy SOAP services without the need of any kind of credentials. This is due to SOAP being enabled by default after installation in order to provide a convenient way to use SOAP samples. However, this feature poses...

Oracle 9iAS OWA_UTIL Stored Procedures Information Disclosure

Oracle 9iAS can provide access to the PL/SQL application OWAUTIL that provides web access to some stored procedures. These procedures, without authentication, can allow users to access sensitive information such as source code of applications, user credentials to other database servers and run...