PT-2013-49: Null Byte Injection in Oracle Containers for J2EE

The specialists of the Positive Research center have detected a Null Byte Injection vulnerability in Oracle Containers for J2EE. Oracle Containers for J2EE does not properly handle a null byte in the path when transferring a request to another static page or a JSP script via pageContext.forward o...

PT-2013-48: CRLF Injection in Oracle Containers for J2EE

The specialists of the Positive Research center have detected a CRLF Injection vulnerability in Oracle Containers for J2EE. Oracle Containers for J2EE does not properly validate the values from the HTTP headers. An attacker can use a crafted malicious HTTP response and display arbitrary data to t...

PT-2013-47: Directory Traversal in Oracle Containers for J2EE

The specialists of the Positive Research center have detected a Directory Traversal vulnerability in Oracle Containers for J2EE when running on Windows. Oracle Containers for J2EE does not properly handle a Request-URI sent by the client. An attacker can apply to an arbitrary script outside of th...

CVE-2013-1514: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote authenticated users to affect integrity via vectors related to RMI Support...

CVE-2013-1542: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime...

CVE-2011-2314: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.2.3 allows remote attackers to affect integrity via unknown vectors related to JavaServer Pages...

CVE-2011-0883: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.2.3, 10.1.3.5, 10.1.4.0.1, and 10.1.4.3 allows remote authenticated users to affect integrity, related to Servlet Runtime in OC4J...

CVE-2010-0067: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors...

CVE-2010-0070: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect integrity via unknown vectors...

Oracle Containers For Java Traversal

Server Version Info: Oracle-Application-Server-10g/10.1.3.1.0 Oracle-HTTP-Server PoC: http://OC4J/web-app/foobar/%c0%ae%c0%ae/WEB-INF/web.xml Related: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938 Explaination: The "%c0%ae%c0%ae" is interpreted as: ".." because on Java's side:...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.3.3, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS06...

CVE-2007-5521

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.3.3, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS06...

CVE-2007-5521: Undefined Security Weakness

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.2, and 10.1.3.3, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS06...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and attack vectors related to Oracle Containers for J2EE, aka 1 OC4J01, 2 OC4J05, and 3 OC4J06...

CVE-2007-0289

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and attack vectors related to Oracle Containers for J2EE, aka 1 OC4J01, 2 OC4J05, and 3 OC4J06...

CVE-2007-0289

Technical details about CVE-2007-0289 are not publicly available in the provided documents. Monitor for updates.

CVE-2007-0289: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and attack vectors related to Oracle Containers for J2EE, aka 1 OC4J01, 2 OC4J05, and 3 OC4J06...

CVE-2007-0284: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.3 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2, have unknown impact and attack vectors related to Oracle Containers for J2EE, aka 1 OC4J03 and 2 OC4J04...

CVE-2006-5366

Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and remote attack vectors related to 1 Oracle Containers for J2EE, aka Vuln OC4J01, and 2 Oracle Process Mgmt & Notification, aka OPMN01...

CVE-2006-5361

Unspecified vulnerability in Oracle Containers for J2EE in Oracle Application Server 9.0.4.3, 10.1.2.0.0, and 10.1.2.0.1, and Oracle Collaboration Suite 9.0.4.2 and 10.1.2, has unknown impact and remote attack vectors, aka Vuln OC4J03...