CVE-2008-2596

Unspecified vulnerability in the Mobile Application Server component in Oracle E-Business Suite 12.0.3 has unknown impact and remote authenticated attack vectors...

CVE-2008-2612

CVE-2008-2612 affects the Hyperion BI Plus component in Oracle Application Server (versions 8.3.2.4, 8.5.0.3, 9.2.0.3, 9.2.1.0, 9.3.1.0). The Oracle CPU July 2008 risk matrix marks this as a remote vulnerability exploitable via HTTP with network access and no authentication, with a base CVSS v2 s...

CVE-2008-2595

CVE-2008-2595 : A pre-authentication denial-of-service vulnerability exists in Oracle Internet Directory (LDAP) within Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2. The issue is caused by a NULL pointer dereference when processing malformed LDAP requests, leading to a crash of the vu...

CVE-2008-2594

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-2593...

CVE-2008-2595

Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researche...

CVE-2008-2596

CVE-2008-2596 affects Oracle E-Business Suite 12.0.3, Mobile Application Server. Oracle’s E-Business Suite risk matrix lists the vulnerability as exploitable with a valid session over HTTP, with CVSS v2 base score 5.5 (Network, Low access complexity, Single authentication, Confidentiality/Integri...

CVE-2008-2594

CVE-2008-2594 is an Oracle Portal vulnerability in Oracle Application Server 10g (10.1.2.3 and 10.1.4.2). The Oracle Application Server risk matrix lists CVE-2008-2594 as affecting Oracle Portal over HTTP with network-vector exploitation and no authentication required, scoring 6.4 (CVSS v2) and i...

CVE-2008-2589

CVE-2008-2589 concerns an SQL injection in Oracle Application Server’s WWV_RENDER_REPORT package used by the Oracle Portal component. Affects Oracle Portal integrated in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.4.1. The vulnerability arises from how the second argument to SHOW execut...

CVE-2008-2589

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.4.1 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims tha...

CVE-2008-2583

Unspecified vulnerability in the sample Discussion Forum Portlet for the Oracle Portal component in Oracle Application Server, as available from OTN before 20080715, has unknown impact and remote attack vectors...

CVE-2008-2612

Unspecified vulnerability in the Hyperion BI Plus component in Oracle Application Server 8.3.2.4, 8.5.0.3, 9.2.0.3, 9.2.1.0, and 9.3.1.0 has unknown impact and remote attack vectors...

Multiple Vendor DNS Protocol Insufficient Transaction ID Randomization DNS Spoofing Vulnerability

Description Multiple vendors' implementations of the DNS protocol are prone to a DNS-spoofing vulnerability because the software fails to securely implement random values when performing DNS queries. Successfully exploiting this issue allows remote attackers to spoof DNS replies, allowing them to...

Microsoft Outlook Web Access for Exchange Server Email Field Cross-Site Scripting Vulnerability

Description Microsoft Outlook Web Access OWA for Exchange Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

Microsoft Windows Explorer saved-search File Remote Code Execution Vulnerability

Description Microsoft Windows Explorer is prone to a remote code-execution vulnerability. Successfully exploiting this issue will allow attackers to execute arbitrary code with the privileges of the user running the affected application. Technologies Affected Avaya Messaging Application Server...

Caucho Resin vulnerable to XSS via "file" parameter to "viewfile"

Overview The "viewfile" command provided by Caucho Resin contains a cross-site scripting XSS vulnerability in the "file" parameter. Description Caucho Resin is a Java-based application server. The "viewfile" command that is provided with the Resin documentation is vulnerable to XSS via the "file"...

CVE-2008-2751

Multiple cross-site scripting XSS vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.101 allow remote attackers to inject arbitrary web script or HTML via the 1 propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.101 allow remote attackers to inject arbitrary web script or HTML via the 1 propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, 2...

CVE-2008-2751

Multiple cross-site scripting XSS vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.101 allow remote attackers to inject arbitrary web script or HTML via the 1 propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, 2...

CVE-2008-2751

CVE-2008-2751 concerns multiple XSS vulnerabilities in the GlassFish 2 Sun Java System Application Server 9.1_01 webadmin interface. The disclosed vectors affect the JSF pages (resourceNode, applications, etc.) via numerous form fields (e.g., jndiProp, resTypeProp, factoryClassProp, descProp, nam...

CVE-2008-2751

Multiple cross-site scripting XSS vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.101 allow remote attackers to inject arbitrary web script or HTML via the 1 propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, 2...