Oracle Application Server XSQL Stylesheet Arbitrary Java Code Execution

The Oracle XSQL Servlet allows arbitrary Java code to be executed by an attacker by supplying the URL of a malicious XSLT stylesheet when making a request to an XSQL page. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details Changes by Tenable: -...

oracle.iss.txt

-----BEGIN PGP SIGNED MESSAGE----- ISS Security Advisory November 10, 1999 Multiple Root Compromise Vulnerabilities in Oracle Application Server Synopsis: Internet Security Systems ISS X-Force has discovered multiple vulnerabilities in the Oracle Application Server OAS that may lead to local...