CVE-2001-1217

Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. dot dot sequences...

CVE-2001-1189

IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script...

Oracle Application Server Web Cache Multiple Remote DoS

According to its version, the version of OracleWebCache installed on the remote host is affected by denial of service vulnerability. A remote attacker may exploit this vulnerability to crash the remote service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

IBM HTTP Server 1.3.x - Source Code Disclosure

IBM HTTP Server 1.3.x - Source Code Disclosure source: https://www.securityfocus.com/bid/3518/info Due to an input validation error in IBM HTTP Server for the AS/400, it is possible for a remote attacker to make a specially web crafted web request which will display script source code. If a '/' i...

IBM HTTP Server 1.3.x - Source Code Disclosure

source: https://www.securityfocus.com/bid/3518/info Due to an input validation error in IBM HTTP Server for the AS/400, it is possible for a remote attacker to make a specially web crafted web request which will display script source code. If a '/' is appended to the end of a request for an...

Lotus Domino View ACL by-pass (#NISR29102001C)

NGSSoftware Insight Security Research Advisory Name: Lotus Domino View ACL by-pass Systems Affected: Lotus Domino Web Server 5.x on all operating systems Severity: Possibly high Vendor URL: http://www.lotus.com/ Author: David Litchfield [email protected] Date: 29th October 2001 Advisory number:...

oracle.9i.path.txt

Product: Oracle 9i Application Server. Description: The Oracle 9i Application Server uses the Apache web server for HTTP service. However, if a request is made for a non-existent .jsp file, the complete path is shown. For instance, if you were to make the following request at a server running...

Allaire JRun Java Application Server vulnerable to Cross-Site Scripting via passing of user input directly to default error page

Overview Web Servers that use the Allaire JRun Java Servlet Container are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or scriptJavaScript, VBScript, Java, etc. in a dynamically generated page based on unvalidated input from...

CVE-2001-0419

Buffer overflow in shared library ndwfn4.so for iPlanet Web Server iWS 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/...

CVE-2001-0419

Buffer overflow in shared library ndwfn4.so for iPlanet Web Server iWS 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/...

CVE-2001-0419

CVE-2001-0419 describes a buffer overflow in the shared library ndwfn4.so used by iPlanet Web Server 4.1 when acting as a web listener for Oracle Application Server 4.0.8.2. An attacker can trigger the overflow by sending a very long HTTP request (e.g., to /jsp/) to cause remote code execution on...

Vulnerability in Oracle E-Business Suite Release 11i Applications Desktop Integrator

Post date: 05/22/01 Vulnerability in Oracle E-Business Suite Release 11i Applications Desktop Integrator Overview A potential security vulnerability has been discovered in Applications Desktop Integrator ADI version 7.X for Oracle E-Business Suite Release 11i. A debug version of the FNDPUB11I.DLL...

CVE-2001-0326

The CVE-2001-0326 entry concerns Oracle Java Virtual Machine (JVM) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1. Description in connected sources indicates an information disclosure vulnerability: remote attackers could read arbitrary files via the .jsp and .sqljsp extens...

Oracle Application Server ndwfn4.so HTTP Request Remote Overflow

It may be possible to make a web server execute arbitrary code by sending it a too long url starting with /jsp/ For example: GET /jsp/AAAA.....AAAAA C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10654; scriptversion"1.27"; scriptcvsdate"Date: 2018/07/16 14:09:13";...

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow source: https://www.securityfocus.com/bid/2569/info The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web...

Oracle Application Server shared library buffer overflow

$Id: safer0016oasadvisory.txt,v 1.3 2001/03/27 10:27:16 vanja Exp $ S.A.F.E.R. Security Bulletin 0016 TITLE : Oracle Application Server shared library buffer overflow DATE : April 10, 2001 NATURE : Remote execution of code, Denial of Service AFFECTED : Oracle application server 4.0.8.2 + iWS...

Дырка в Oracle Application Server (shared library buffer overflow)

Переполнение буфера при длинном запросе...

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow

source: https://www.securityfocus.com/bid/2569/info The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than...

CHINANSL Security Advisory(CSA-200107)

Topic: IBM WCS 4.0.1 + Application Server 3.0.2 for Solaris 2.7 show ".jsp" source Vulnerability. vulnerable: Solaris 2.7 + IBM WCS4.0,Application Server 3.0.2 discussion: follow URL insert "/" will be downloading ".jsp" source. exploits: http://target/index.jsp/ solution: to...

Oracle Application Server XSQL Stylesheet Arbitrary Java Code Execution

The Oracle XSQL Servlet allows arbitrary Java code to be executed by an attacker by supplying the URL of a malicious XSLT stylesheet when making a request to an XSQL page. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details Changes by Tenable: -...