CVE-2002-0560

PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWAUTIL stored procedures 1 OWAUTIL.signature, 2 OWAUTIL.listprint, or 3 OWAUTIL.showquerycolumns...

CVE-2002-0561

The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings...

CVE-2002-0562

The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa...

Oracle Application Server contains format string vulnerability

Overview The CERT/CC is aware of a report about a "remotely exploitable format string vulnerability in Oracle Application Server" that could allow an unauthenticated, remote attacker to execute arbitrary code on a vulnerable system. Description Oracle Application Server uses the Apache HTTP Serve...

Oracle 9iAS SOAP components allow anonymous users to deploy applications by default

Overview Oracle Application Server 9iAS installs with Simple Object Access Protocol SOAP enabled by default and allows unauthenticated remote users to deploy and undeploy SOAP services and providers. Description Oracle Application Server 9iAS supports Simple Object Access Protocol SOAP, an...

Oracle 9iAS allows anonymous remote users to view sensitive Apache services by default

Overview Oracle Application Server 9iAS allows remote users to access several Apache services without authentication. Description Oracle Application Server 9iAS includes the Apache Web server and several Apache services. In the default install configuration, many of these services, including...

Multiple Oracle 9iAS sample pages contain vulnerabilities

Overview Oracle Application Server version 9iAS installs with sample pages that demonstrate various functions of the software. Many of these pages can be used by attackers to breach the security of the system. Description A fresh installation of Oracle Application Server version 9iAS and possibly...

Oracle Application Server XSQLServlet XSQLConfig.xml Information Disclosure

It is possible to read the contents of the XSQLConfig.xml file which contains sensitive information. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title, touched up description 6/12/09 - Added patch date a...

CVE-2001-1371

The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager...

Oracle Application Server Web Cache Multiple Remote DoS

According to its version, the version of OracleWebCache installed on the remote host is affected by denial of service vulnerability. A remote attacker may exploit this vulnerability to crash the remote service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2001-0419

Buffer overflow in shared library ndwfn4.so for iPlanet Web Server iWS 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/...

CVE-2001-0419

Buffer overflow in shared library ndwfn4.so for iPlanet Web Server iWS 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/...

CVE-2001-0419

CVE-2001-0419 describes a buffer overflow in the shared library ndwfn4.so used by iPlanet Web Server 4.1 when acting as a web listener for Oracle Application Server 4.0.8.2. An attacker can trigger the overflow by sending a very long HTTP request (e.g., to /jsp/) to cause remote code execution on...

CVE-2001-0326

The CVE-2001-0326 entry concerns Oracle Java Virtual Machine (JVM) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1. Description in connected sources indicates an information disclosure vulnerability: remote attackers could read arbitrary files via the .jsp and .sqljsp extens...

Oracle Application Server ndwfn4.so HTTP Request Remote Overflow

It may be possible to make a web server execute arbitrary code by sending it a too long url starting with /jsp/ For example: GET /jsp/AAAA.....AAAAA C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10654; scriptversion"1.27"; scriptcvsdate"Date: 2018/07/16 14:09:13";...

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow source: https://www.securityfocus.com/bid/2569/info The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web...

Oracle Application Server shared library buffer overflow

$Id: safer0016oasadvisory.txt,v 1.3 2001/03/27 10:27:16 vanja Exp $ S.A.F.E.R. Security Bulletin 0016 TITLE : Oracle Application Server shared library buffer overflow DATE : April 10, 2001 NATURE : Remote execution of code, Denial of Service AFFECTED : Oracle application server 4.0.8.2 + iWS...

Дырка в Oracle Application Server (shared library buffer overflow)

Переполнение буфера при длинном запросе...

Oracle Application Server 4.0.8.2 - ndwfn4.so Buffer Overflow

source: https://www.securityfocus.com/bid/2569/info The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than...

Oracle Application Server XSQL Stylesheet Arbitrary Java Code Execution

The Oracle XSQL Servlet allows arbitrary Java code to be executed by an attacker by supplying the URL of a malicious XSLT stylesheet when making a request to an XSQL page. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details Changes by Tenable: -...