CVE-2008-7238

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow 1 local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component APP01; 2 remote attackers to affect confidentiality via unknown vectors related to the Oracle...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04...

CVE-2008-7233

Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Oracle Jinitiator component, aka AS02...

CVE-2008-7235

Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04...

Design/Logic Flaw

Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 and 10.1.3.1 allows remote attackers to affect integrity via unknown vectors, aka AS05...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow 1 local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component APP01; 2 remote attackers to affect confidentiality via unknown vectors related to the Oracle...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the 1 Oracle Application Object Library APP02 and 2 Oracle Applications Manager APP04...

CVE-2008-7234

CVE-2008-7234 concerns an unspecified vulnerability in the Oracle BPEL Worklist Application component of Oracle Application Server 10.1.2.2 and 10.1.3.3. The description states that remote attackers can affect confidentiality, integrity, and availability via unknown vectors (aka AS03). The CVSS b...

CVE-2008-7238

CVE-2008-7238 concerns multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3. Affected areas include components Mobile Application Server (APP01), Oracle Applications Framework (APP03), CRM Technical Foundation (APP05), Oracle Application Object Library (APP06), and Oracle Applic...

CVE-2008-7238

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow 1 local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component APP01; 2 remote attackers to affect confidentiality via unknown vectors related to the Oracle...

CVE-2008-7235

CVE-2008-7235 affects Oracle Forms in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3. The vulnerability is described as unspecified, with remote attackers able to affect integrity via unknown vectors (aka AS04). The connected records confirm the affected stack but Do not provide c...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Authentication flaw

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-1976

Unspecified vulnerability in the HTTP Server component in Oracle Application Server 10.1.2.3 allows remote attackers to affect integrity via unknown vectors...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Oracle Application Server Spy Servlet SID Enumeration

This module makes a request to the Oracle Application Server in an attempt to discover the SID. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Application Server Spy Servlet SID...

Update Protection against Oracle Application Server BPEL Module Cross Site Scripting

Oracle Application Server is vulnerable to cross-site scripting due to lack of validation of user supplied data. Oracle Application Server is a multi-platform solution for developing and deploying enterprise applications and web sites. The flaw may be exploited by attackers to execute arbitrary...