473 matches found
Oracle Application Server Web Cache <= 9.0.4.0 Multiple Vulnerabilities
The remote host is running a version of Oracle Application Server Web Cache version 9.0.4.0 or older. The installed version is affected by a heap overflow vulnerability. Provided Web Cache is running and configured to listen on Oracle Application Server Web Cache listener port and accept requests...
CVE-2004-1877
The psubmiturl value in the sample login form in the Oracle 9i Application Server 9iAS Single Sign-on Administrators Guide, Release 29.0.2 for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password...
Oracle Application Server Web Cache contains heap overflow vulnerability
Overview Oracle Application Server Web Cache contains a heap overflow vulnerability in the handling of client requests that could result in arbitrary code execution. Description The Oracle Web Cache acts as a reverse proxy, caching static and dynamic content generated from Oracle Application web...
Multiple SQL Injection Vulnerabilities in Oracle Application Server 9i and RDBMS (#NISR05112003)
NGSSoftware Insight Security Research Advisory Name : Multiple Oracle Application Server SQL Injection Vulnerabilities Systems Affected: All OS platforms; Oracle9i Application Server Release 1 and 2 and RDBMS Severity : High Risk Vendor URL : http://www.oracle.com/ Author : David Litchfield...
CVE-2001-1371
The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager...
CVE-2001-1371: Undefined Security Weakness
The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager...
CVE-2002-2153
Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote attackers to execute arbitrary code...
CVE-2002-1635
The Apache configuration file httpd.conf in Oracle 9i Application Server 9iAS uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin...
Oracle Application Server Web Cache HTTP Request Overflow
It may be possible to make the Oracle9i application server crash or execute arbitrary code by sending it a too long url specially crafted URL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References: Date: Thu, 18 Oct 2001 16:16:20 +0200 From: "andreas junestam" Affiliation: Defcom To:...
CVE-2002-0569
Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet XSQLServlet...
CVE-2002-0560
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWAUTIL stored procedures 1 OWAUTIL.signature, 2 OWAUTIL.listprint, or 3 OWAUTIL.showquerycolumns...
CVE-2002-0561
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings...
CVE-2002-0562
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa...
Oracle Application Server contains format string vulnerability
Overview The CERT/CC is aware of a report about a "remotely exploitable format string vulnerability in Oracle Application Server" that could allow an unauthenticated, remote attacker to execute arbitrary code on a vulnerable system. Description Oracle Application Server uses the Apache HTTP Serve...
Oracle 9iAS SOAP components allow anonymous users to deploy applications by default
Overview Oracle Application Server 9iAS installs with Simple Object Access Protocol SOAP enabled by default and allows unauthenticated remote users to deploy and undeploy SOAP services and providers. Description Oracle Application Server 9iAS supports Simple Object Access Protocol SOAP, an...
Oracle 9iAS allows anonymous remote users to view sensitive Apache services by default
Overview Oracle Application Server 9iAS allows remote users to access several Apache services without authentication. Description Oracle Application Server 9iAS includes the Apache Web server and several Apache services. In the default install configuration, many of these services, including...
Multiple Oracle 9iAS sample pages contain vulnerabilities
Overview Oracle Application Server version 9iAS installs with sample pages that demonstrate various functions of the software. Many of these pages can be used by attackers to breach the security of the system. Description A fresh installation of Oracle Application Server version 9iAS and possibly...
Oracle Application Server XSQLServlet XSQLConfig.xml Information Disclosure
It is possible to read the contents of the XSQLConfig.xml file which contains sensitive information. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title, touched up description 6/12/09 - Added patch date a...
CVE-2001-1371
The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager...
Oracle Application Server Web Cache Multiple Remote DoS
According to its version, the version of OracleWebCache installed on the remote host is affected by denial of service vulnerability. A remote attacker may exploit this vulnerability to crash the remote service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...