CVE-2002-0559

The CVE-2002-0559 entry concerns a buffer overflow in Oracle9i Application Server’s Apache PL/SQL module exposed via the PL/SQL gateway (mod_plsql). The vulnerability arises from processing long inputs (e.g., long HTTP requests, long DAD passwords, long Authorization headers, or long cache direct...

CVE-2004-1368

The CVE-2004-1368 entry affects Oracle ISQL*Plus in Oracle 10g Application Server. The vulnerability allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script, enabling potential arbitrary-file execution on the affected server. The ac...

CVE-2006-5361

Technical details for CVE-2006-5361 are not publicly provided in the supplied documents; monitor for updates.

CVE-2007-0280

CVE-2007-0280 describes a buffer overflow in Oracle Process Mgmt & Notification (OPMN01) affecting Oracle HTTP Server 9.0.1.5; Application Server 9.0.4.3 and 10.1.2.x; and Collaboration Suite 9.0.4.2 and 10.1.2. Oracle notes in the description that OPMN01 is believed to be the ONS buffer overflow...

CVE-2009-1009

CVE-2009-1009 concerns Oracle Outside In Technology (Outside In SDK/HTML Export) used with Oracle Application Server 8.1.9. The issue is a set of buffer-overflow vulnerabilities in processing Microsoft Excel spreadsheet records, caused by missing bounds checks when handling records/arrays of stru...

CVE-2004-1362

CVE-2004-1362 affects the PL/SQL module of the Oracle HTTP Server in Oracle Application Server 10g when using the WE8ISO8859P1 character set. The issue is a character conversion flaw that allows remote attackers to bypass access restrictions for certain procedures via an encoded URL containing “%...

CVE-2009-0974

Technical details about CVE-2009-0974 are not publicly available in the provided documents. No specifics on affected products, root cause, or fixes are present. Monitor for updates from Oracle security advisories and vulnerability databases.

CVE-2009-1008

Technical details for CVE-2009-1008 are not provided in the connected documents. Monitor for updates from Oracle and security advisories.

CVE-2009-1010

CVE-2009-1010 is a buffer/heap overflow in Oracle Outside In Technology (Outside In SDK HTML Export 8.2.2/8.3.0; affected variants include 8.3.0.5129, 8.2.2.4866, and related builds). iDefense describes multiple integer overflow paths when processing Excel records, leading to heap buffer overflow...

CVE-2007-0282

Concrete details exist in connected documents for the Oracle Process Mgmt & Notification (OPMN) component: a format string vulnerability in the OPMN daemon used by Oracle Grid/Enterprise components (e.g., 10.2.0.1) that can be exploited by crafting the URI in an HTTP request to port 6003, enablin...

CVE-2002-1858

CVE-2002-1858 affects Oracle9i Application Server (versions 1.0.2.2 and 9.0.2 through 9.0.2.0.1) when running on Windows. It allows remote attackers to disclose contents of the WEB-INF directory (Java class files and config) by requesting the directory with a trailing dot (WEB-INF.). The connecte...

CVE-2008-0348

Technical details for CVE-2008-0348 are not publicly available in the provided documents. Monitor for updates in the connected sources.

CVE-2002-1632

CVE-2002-1632 is documented in multiple security feeds as an information disclosure flaw in Oracle 9i Application Server (9iAS). The affected component is the 9iAS sample pages, which can leak environment variables and other sensitive information through the pages named info.jsp, printenv, echo, ...

CVE-2006-0435

The CVE-2006-0435 entry concerns Oracle PL/SQL Gateway/PLSQLExclusion bypass vulnerability (PLSQL01). Public sources (CERT VU and NVD) describe that the Oracle PL/SQL Gateway fails to validate HTTP requests, potentially allowing a remote attacker to bypass access controls and execute SQL commands...

CVE-2007-5520

Technical details for CVE-2007-5520 are not publicly provided in the supplied documents; the entry remains with unspecified impact and remote vectors. Monitor for updates from official advisories to obtain affected products, versions, and remediation guidance.

CVE-2009-0994

Oracle BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 has an unspecified vulnerability leading to confidentiality impact for remote authenticated users (vectors not disclosed). Affected products are BI Publisher within Oracle Application Server; ro...

CVE-2009-1011

CVE-2009-1011 concerns a multiple integer overflow in Oracle Outside In Technology as included in Oracle Application Server (8.2.2 and 8.3.0). The vulnerability arises when Outside In processes an optional data stream inside Microsoft Office files; an unchecked integer value can trigger arithmeti...

CVE-2001-0326

The CVE-2001-0326 entry concerns Oracle Java Virtual Machine (JVM) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1. Description in connected sources indicates an information disclosure vulnerability: remote attackers could read arbitrary files via the .jsp and .sqljsp extens...

CVE-2005-3445

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2006-5356

Technical details for CVE-2006-5356 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2007-2119

CVE-2007-2119 is an XSS vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. The issue affects boundary_rules.jsp and allows remote attackers to inject arbitrary HTML or script via the EXPTYPE parameter. Affected components include the Oracle Database Server variant...

CVE-2004-1707

Oracle 8i/9i and IAS 9.0.2.0.1 on Unix are affected by CVE-2004-1707 due to the dbsnmp and nmo programs. They search a default library path and execute libraries with elevated privileges, enabling certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0. No additional ...

CVE-2005-1383

The CVE-2005-1383 issue affects Oracle Application Server’s Oracle HTTP Server (OHS) when UseWebCacheIP is disabled. An attacker can bypass mod_access restrictions by sending a request to the webcache TCP port 7778, leading to unauthorized access to protected resources. Connected advisories confi...

CVE-2006-0285

CVE-2006-0285 is an unspecified vulnerability in the Java Net component of Oracle Database Server (versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.4) and Oracle Application Server (1.0.2.2, 9.0.4.2, 10.1.2.0.2). The available documents describe the issue as having unspecified impact and ...

CVE-2007-5531

Technical details are not publicly available in the provided documents for CVE-2007-5531. The entry only notes an unspecified vulnerability in Oracle Help for Web with unknown impact and remote vectors. No vendor/version/patch details are given. Monitor for updates.

CVE-2002-1631

CVE-2002-1631 corresponds to a SQL injection vulnerability in the query.xsql sample page of Oracle 9i Application Server (9iAS). The affected component is the query.xsql page within the Oracle XSQL/9iAS environment, and the underlying root cause is unsafely handling the sql parameter in the page,...

CVE-2002-1636

CVE-2002-1636 affects Oracle 9i Application Server (9iAS) via the htp PL/SQL package. The vulnerability exists in htp.print where user-supplied cbuf can inject arbitrary script/HTML, enabling remote XSS. No remediation or fix version is provided in the supplied documents.

CVE-2005-1495

CVE-2005-1495 affects Oracle Database 9i/10g where Fine Grained Auditing (FGA) is disabled after the SYS user executes a SELECT on an FGA object, making detection harder and enabling potential evasion of auditing. The available documents describe the vulnerability and its impact but do not provid...

CVE-2005-3449

CVE-2005-3449 pertains to Oracle Application Server 9.0–10.1.2.0, with multiple unspecified vulnerabilities affecting components AS02 (Containers for J2EE), AS07 (Internet Directory), AS09 (Report Server), and AS11 (Web Cache). The connected documents do not provide concrete technical details (no...

CVE-2006-5359

Technical details about CVE-2006-5359 are not publicly available in the provided documents. Monitor for updates from official advisories; current sources only reference generic vulnerabilities in Oracle Reports Developer without specifics.

CVE-2007-0222

CVE-2007-0222 is a directory traversal vulnerability in Oracle Application Server 10g (10.1.3.0.0) specifically in the EmChartBean server-side component. It allows remote, unauthenticated attackers to read arbitrary files outside the application root (likely via “..” in requests to the beanId par...

CVE-2007-1609

CVE-2007-1609 is a cross-site scripting (XSS) vulnerability in Oracle Application Server 10g (DMS), specifically in servlet/Spy of Dynamic Monitoring Services. Exploitation involves injecting arbitrary script/HTML via the table parameter. The description notes a possible relation to CVE-2002-0563...

CVE-2007-3859

Technical details for CVE-2007-3859 are not publicly available in the provided documents. No specifics on affected product version, root cause, or impact are given here; monitor for updates.

CVE-2007-3861

Technical details for CVE-2007-3861 are not publicly available in the provided documents; no specific affected products, root cause, or remediation are given. Monitor for official updates.

CVE-2001-1217

CVE-2001-1217 describes a directory traversal vulnerability in the PL/SQL Apache module (mod_plsql/mod_plsql) of Oracle 9i Application Server. The issue allows remote attackers to read sensitive files outside the web server’s root by crafting a request with double URL encoded sequences (..). Affe...

CVE-2005-1496

Oracle 10g DBMS_Scheduler Privilege Escalation (CVE-2005-1496): A flaw in the DBMS_Scheduler package allows a user with CREATE JOB privileges to switch SESSION_USER to SYS, enabling privilege escalation. Affected: Oracle 10g DBMS_Scheduler component. Root cause: vulnerability in how DBMS_Schedule...

CVE-2005-3448

Technical details for CVE-2005-3448 are not publicly available in the provided documents. Monitor for updates from Oracle advisories and vendor bulletins to learn affected versions, impact, and remediation.

CVE-2009-0983

Technical details for CVE-2009-0983 are not provided in the connected documents. The initial description notes an unspecified vulnerability in Oracle Application Server Portal components. Monitor for updates from Oracle CPU advisories and CVE records.

CVE-2009-3407

Mode C (Normal): The CVE-2009-3407 vulnerability affects Oracle Application Server Portal (Portal component) in 10.1.2.3 and 10.1.4.2. It is exploitable over HTTP by remote attackers without authentication, with a CVSS v2 base score of 4.3 (Network, Medium complexity, no auth, Partial integrity i...

CVE-2002-1630

The CVE-2002-1630 entry affects Oracle 9i Application Server (9iAS). The vulnerability is in the sendmail.jsp sample page, described as allowing remote attackers to send arbitrary emails. Public details in the provided documents confirm the affected component is the sendmail.jsp page, but there i...

CVE-2005-3446

Technical details for CVE-2005-3446 are not publicly available in the provided documents. Monitor for updates.

CVE-2006-0286

The CVE-2006-0286 entry concerns Oracle HTTP Server in Oracle Database Server (various versions). The connected documents identify an unspecified vulnerability with unspecified impact/attack vectors (Oracle Vuln# OHS01) and reference multiple advisories noting potential information disclosure and...

CVE-2006-0287

Affected software: Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2. The CVE-2006-0287 entry is described as an unspecified vulnerability with unspecified impact/attack vectors per Oracle (Oracle Vuln# OHS02). Some connected sources (Oracle HTTP Se...

CVE-2007-0285

CVE-2007-0285 affects Oracle software including Application Server (9.0.4.3, 10.1.2.0.2, 10.1.2.2), Collaboration Suite (9.0.4.2, 10.1.2), and E-Business Suite/Applications 11.5.10CU2, with the vulnerability tied to Oracle Reports Developer (REP01). The description notes an unspecified vulnerabil...

CVE-2009-1990

CVE-2009-1990 affects Oracle Application Server BI Enterprise Edition (Business Intelligence Enterprise Edition component) in Oracle Application Server 10.1.3.4.1. The Oracle CPU/Oracle Application Server risk matrix lists this as a local vulnerability with confidentiality impact Partial and no e...

CVE-2006-5358

Technical details of CVE-2006-5358 are not publicly available in the provided documents. Monitor for updates from Oracle advisories or security bulletins; current sources confirm an unspecified vulnerability in Oracle Forms without specifics.

CVE-2006-5364

Technical details for CVE-2006-5364 are not publicly available in the provided documents; monitor for updates from official advisories.

CVE-2007-0287

Technical details are not publicly available in the provided documents for CVE-2007-0287; no affected products, impact, or remediation are specified here. Monitor for updates.

CVE-2008-2614

CVE-2008-2614 affects the Oracle HTTP Server component bundled with Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.3.3. The CVE entry itself is generic (unknown impact and remote vectors). Oracle’s July 2008 Critical Patch Update lists CVE-2008-2614 in the Oracle Application Server risk ma...

CVE-2000-1236

Oracle IAS 3.0.7 and earlier are affected by a SQL injection in the mod_sql component. The vulnerability allows remote attackers to execute arbitrary SQL commands via the URL’s query string. The connected Nessus entry confirms this CVE-2000-1236 detail as part of Oracle Application Server multi-v...