CVE-2008-2593

CVE-2008-2593 and CVE-2008-2594 refer to distinct vulnerabilities in the Oracle Portal component of Oracle Application Server 10g (versions 10.1.2.3 and 10.1.4.2). The Initial description indicates these are unspecified vulnerabilities with unknown impact and remote vectors. Connected documentati...

CVE-2008-2583

CVE-2008-2583 affects Oracle Portal’s sample Discussion Forum Portlet (Oracle Application Server 10g). The vulnerability resides in the Discussion Forum Portlet distributed via OTN prior to 20080715, enabling remote exploitation over a network with unknown impact per the initial description, but ...

Oracle Application Server Portal 10g Authentication Bypass

The remote host is running Oracle Application Server. By sending a specially crafted GET request to the version of Oracle Application Server installed on the remote host, an unauthenticated attacker can access potentially sensitive files listed under the directory '/davportal/portal'. C Tenable...

Design/Logic Flaw

Oracle Application Server OracleAS Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /davportal/portal/ by sending a request containing a trailing "%0A" encoded line feed, then using the session ID that is generated from that request. NOTE: as of...

CVE-2008-2138

Oracle Application Server OracleAS Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /davportal/portal/ by sending a request containing a trailing "%0A" encoded line feed, then using the session ID that is generated from that request. NOTE: as of...

Oracle Application Server 10G ORA_DAV Basic Authentication Bypass Vulnerability

Affected Software/Device: Oracle Application Server Portal Vulnerability: Authentication Bypass Tested Version: 10G Risk: Medium Description: Oracle Application Server Portal OracleAS Portal is a Web-based application for building and deploying portals. It provides a secure, manageable environmen...

Oracle Application Server unauthorized access

It's possible to bypass authentication...

oracleasp-bypass.txt

Affected Software/Device: Oracle Application Server Portal Vulnerability: Authentication Bypass Tested Version: 10G Risk: Medium Description: Oracle Application Server Portal OracleAS Portal is a Web-based application for building and deploying portals. It provides a secure, manageable environmen...

Authorization

Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows030000.wwvexecuteimmediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher...

Buffer overflow

Unspecified vulnerability in the Oracle Dynamic Monitoring Service component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.3.3 has unknown impact and remote attack vectors, aka AS02...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Jinitiator component in Oracle Application Server 1.3.1.14 has unknown impact and remote attack vectors, aka AS01...

CVE-2008-1825

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 has unknown impact and remote attack vectors, aka AS03...

CVE-2008-1822

Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02...

CVE-2008-1823

Technical details about CVE-2008-1823 are not publicly provided in the supplied documents. The initial description remains high‑level (unspecified vulnerability with unknown impact). Monitor forUpdates as new information may emerge.

Multiple SQL Injection Flaws in Oracle CTX_DOC package

NGSSoftware Insight Security Research Advisory Name: Multiple SQL Injection Flaws in Oracle CTXDOC package Systems Affected: Oracle 10g release 1 and 2 Severity: High Vendor URL: http://www.oracle.com/ Author: David Litchfield [email protected] Reported: 6 June 2005 Date of Public Advisory:...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Process Mgmt & Notification component in Oracle Application Server 10.1.3.3 has unknown impact and remote attack vectors, aka AS01...

CVE-2007-5524

Unspecified vulnerability in the Oracle Single Sign-On component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS09 or AS9...

CVE-2007-5523

Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.4.0, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS08...

CVE-2007-5521

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.3.3, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS06...

Design/Logic Flaw

Unspecified vulnerability in Oracle Help for Web, as used in Oracle Application Server, Oracle Database 10.2.0.3, and Enterprise Manager 10.1.0.6, has unknown impact and remote attack vectors, aka EM02...