[SNS Advisory No.84] Oracle Application Server HTTP Response Splitting Vulnerability

---------------------------------------------------------------------- SNS Advisory No.84 Oracle Application Server HTTP Response Splitting Vulnerability Problem first discovered on: Tue, 01 Feb 2005 Published on: Tue, 21 Oct 2005...

Run any OS Command via unauthorized Oracle Forms

Name Run any OS Command via unauthorized Oracle Forms Systems Affected Oracle Web Forms 4.5, 5.0, 6.0, 6i, 9i, 10g Severity High Risk Category OS command execution Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 18 July 2005 V 1.00 Advisory...

Various Cross-Site-Scripting Vulnerabilities in Oracle Reports

Name Various Cross-Site-Scripting Vulnerabilities in Oracle Reports Systems Affected Oracle Reports 9.0.2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Inital bug report...

Run any OS Command via unauthorized Oracle Reports

Name Run any OS Command via unauthorized Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category OS command execution Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-014...

Overwrite any file via desname in Oracle Reports

Name Overwrite any file via desname in Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category File overwrite Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-005 Inital bug...

Oracle Application Server < 10.1.0.0.4 Logging Service Interruption

Binary data 2882.prm...

Oracle Application Server < 10.1.0.0.3 Privilege Escalation

Binary data 2881.prm...

CVE-2005-1383

The CVE-2005-1383 issue affects Oracle Application Server’s Oracle HTTP Server (OHS) when UseWebCacheIP is disabled. An attacker can bypass mod_access restrictions by sending a request to the webcache TCP port 7778, leading to unauthorized access to protected resources. Connected advisories confi...

CVE-2005-1383

The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server modaccess restrictions via a request to the webcache TCP port 7778...

Oracle Application Server Webcache Requests OHS mod_access Restriction Bypass

The version of Oracle HTTP Server OHS installed on the remote host fails to prevent users from accessing protected URLs by using the Web Cache rather than OHS directly. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18181; scriptversion"1.17";...

Append file in Oracle Webcache 9i

Name Append file vulnerability in Oracle Webcache 9i Systems Affected Oracle Application Server with Webcache 9i Severity Medium Risk Category Corruption of files Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 2005 V 1.00 Advisory...

Webcache Client Requests bypasses OHS mod_access restrictions

Name Webcache Client Requests bypasses OHS modaccess Restrictions Systems Affected Oracle Application Server - OHS 1.0.2 - 10.x Severity Low Risk Category Bypass protected URLs via Webcache Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 200...

Cross Site Scripting in Oracle Webcache 9i

Name Cross Site Scripting in Oracle Webcache 9i Systems Affected Oracle Application Server with Webcache 9i Severity Low Risk Category Cross Site Scripting Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 26 Apr 2005 V 1.00 Advisory AKSEC2003-011 Ti...

Oracle Application Server 9i - Webcache Cache_dump_file Cross-Site Scripting

source : https://www.securityfocus.com/bid/13421/info A remote cross-site scripting vulnerability affects the Oracle Application Server 9i Webcache administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamical...

Oracle Application Server Web Cache OHS mod_access Authentication Bypass

Binary data 2866.prm...

Oracle Application Server 10g Detection

Binary data 2830.prm...

Oracle Application Server J2EE Container Detection

Binary data 2831.prm...

CVE-2004-1362

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded...

US-CERT Technical Cyber Security Alert TA04-245A -- Multiple Vulnerabilities in Oracle Products

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA04-245A Multiple Vulnerabilities in Oracle Products Original release date: September 1, 2004 Last revised: -- Source: US-CERT Systems Affected The following Oracle applications are affected: Oracle Database 10g Release...

CVE-2002-0842

Format string vulnerability in certain third party modifications to moddav for logging bad gateway messages e.g. Oracle9i Application Server 9.0.2 allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string...