CVE-2008-7236

Affected software: Oracle Application Server 10.1.2.2 and 10.1.3.1, specifically the Oracle JDeveloper component. The entry describes an unspecified vulnerability that allows remote attackers to affect integrity via unknown vectors (aka AS05). The publicly available data provide no concrete explo...

CVE-2000-1235

Oracle IAS 3.0.7 and earlier are affected by CVE-2000-1235 due to default configurations of the port listener and mod_plsql, enabling remote attackers to view privileged database information via HTTP requests for DAD files. Affected component is the mod_plsql DAD handling exposed by default; root...

CVE-2001-0419

CVE-2001-0419 describes a buffer overflow in the shared library ndwfn4.so used by iPlanet Web Server 4.1 when acting as a web listener for Oracle Application Server 4.0.8.2. An attacker can trigger the overflow by sending a very long HTTP request (e.g., to /jsp/) to cause remote code execution on...

CVE-2002-1635

The CVE-2002-1635 entry concerns Oracle 9i Application Server (9iAS) where the Apache httpd.conf uses a Location alias for /perl instead of a ScriptAlias. This misconfiguration enables a remote attacker to read the source code of arbitrary CGI files via a URL that targets /perl rather than /cgi-b...

CVE-2006-0274

Technical details for CVE-2006-0274 are not publicly provided in the supplied documents. Monitor for updates from Oracle/vendor advisories; current entries note unspecified impact, but no concrete exploit vectors or version-specific remediation are available here.

CVE-2006-3711

Technical details about CVE-2006-3711 are not publicly available in the provided documents. Monitor for updates.

CVE-2008-3975

Technical details for CVE-2008-3975 are not publicly available in the provided documents. Monitor for updates from Oracle/vendor advisories; no confirmed impact, affected versions, exploit methods, or fixes are documented here.

CVE-2009-1976

CVE-2009-1976 is an Oracle Application Server HTTP Server vulnerability. The connected CPU advisory (July 2009) fixes multiple vulnerabilities, including CVE-2009-1976, in Oracle Application Server 10g Release 2 (10.1.2.x) with affected build 10.1.2.3.0. The CVSS base score shown in the risk matr...

CVE-2002-2345

The CVE-2002-2345 entry concerns Oracle 9i Application Server 9.0.2, where the web cache administrator interface password is stored in plaintext. This credential leakage could allow remote attackers to access the administrator interface, implying unauthorized access to cached credentials. Public ...

CVE-2005-3453

Technical details for CVE-2005-3453 are not publicly provided in the supplied documents; the connected data lists only generic references to multiple unspecified vulnerabilities in Oracle Web Cache. Monitor for updates.

CVE-2006-5353

Technical details (affected product/version, root cause, impact, and remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2006-5355

Technical details for CVE-2006-5355 are not publicly available in the provided documents; monitor for updates.

CVE-2007-0288

Technical details of CVE-2007-0288 are not publicly provided in the supplied documents; no affected products, vectors, or fixes are specified. Monitor for updates.

CVE-2007-2120

The CVE-2007-2120 entry affects the Oracle Discoverer servlet component of Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0. The vulnerability allows remote attackers to trigger a shutdown of the Oracle TNS Listener by sending a request containing the database/TNS alias with a TNS ST...

CVE-2008-2593

CVE-2008-2593 and CVE-2008-2594 refer to distinct vulnerabilities in the Oracle Portal component of Oracle Application Server 10g (versions 10.1.2.3 and 10.1.4.2). The Initial description indicates these are unspecified vulnerabilities with unknown impact and remote vectors. Connected documentati...

CVE-2009-0996

CVE-2009-0996 affects the BI Publisher component in Oracle Application Server 10.1.3.2.1, 10.1.3.3.3 and 10.1.3.4. The vulnerability is described as unspecified and allows remote authenticated users to affect confidentiality via unknown vectors. Oracle’s April 2009 CPU advisory (cpuapr2009) provi...

CVE-2009-1017

Oracle BI Publisher in Oracle Application Server 5.6.2 and certain 10.1.3.x builds contains an unspecified vulnerability that allows remote authenticated users to affect confidentiality via unknown vectors. The issue is associated with BI Publisher (Oracle XML Publisher/BI Publisher) components a...

CVE-2004-1877

The CVE-2004-1877 issue is documented in connected sources as a phishing vulnerability in Oracle 9iAS Single Sign-On. Specifically, the p_submit_url value in the sample login form for Oracle SSO (9iAS, Release 2/9.0.2) can be exploited by remote attackers to spoof the login page, potentially caus...

CVE-2005-3450

Technical details about CVE-2005-3450 (affected component, impact, exploitability) are not provided in the supplied documents. Monitor for updates.

CVE-2006-3713

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2006-5360

Technical details for CVE-2006-5360 are not publicly available in the provided documents. Monitor for updates; no further specifics (impact, vectors, or remediation) can be stated from these sources.

CVE-2007-0284

Technical details (affected products, vulnerable components, impact, or fixes) are not publicly provided in the supplied documents; monitor for updates.

CVE-2007-2122

Technical details about CVE-2007-2122 are not publicly available in the provided documents. Monitor for updates from authoritative sources; the materials here only reiterate an unspecified vulnerability in the Oracle Application Server Wireless component without specifics.

CVE-2008-3986

CVE-2008-3986 affects the Oracle Discoverer Administrator component in Oracle Application Server 9.0.4.3 and 10.1.2.2. Local users can impact confidentiality via unknown vectors. The connected Oracle CPU Oct 2008 advisory lists this as a patched vulnerability; apply the CPUOct2008 fixes to mitiga...

CVE-2008-3987

Technical details about CVE-2008-3987 are not publicly provided in the supplied documents; references note an unspecified local vulnerability in Oracle Discoverer Desktop 10.1.2.3. Monitor for updates.

CVE-2005-3451

Technical details for CVE-2005-3451 are not provided in the supplied documents. No affected products or fixes are specified. Monitor for updates.

CVE-2006-3710

CVE-2006-3710 technical details are not provided in the supplied documents; no affected product versions, impact, or remediation are disclosed here. Monitor for updates as new information may be published.

CVE-2006-3714

Technical details for CVE-2006-3714 are not provided in the supplied documents. No affected product/version, root cause, impact, or remediation information is included. Monitor for updates from official advisories.

CVE-2009-1999

Oracle Application Server: CVE-2009-1999 affects the Business Intelligence Enterprise Edition component. The Oracle Application Server risk matrix lists a network-exploitable vulnerability with CVSS v2 base score 4.3 (Partial integrity impact). The vulnerability is described as an unspecified iss...

CVE-2002-0842

CVE-2002-0842 is a format-string vulnerability in Oracle’s mod_dav extension (used for logging gateway errors) that could enable remote code execution via a crafted destination URI triggering a 502 Bad Gateway. The vulnerability affects Oracle9i Application Server 9.0.2 (and related mod_dav code ...

CVE-2002-2347

CVE-2002-2347 is a cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (hellouser.jsp, welcomeuser.jsp, usebean.jsp) in Oracle 9i Application Server versions 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2. The issue allows remote attackers to inject arbitrary web script or H...

CVE-2006-5362

Technical details for CVE-2006-5362 are not provided in the supplied documents. No product/version specifics, impact, or remediation are disclosed here. Monitor for updates from authoritative sources.

CVE-2007-2124

Technical details about CVE-2007-2124 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2007-3553

CVE-2007-3553 is an XSS in Oracle Application Server 11i's Rapid Install Web Server. The vulnerability allows remote attackers to inject arbitrary script/HTML via a URL to the Secondary Login Page (demonstrated with pls/ and pls/MSBEP004/). Connected Nessus content explicitly references this CVE ...

CVE-2007-5519

Technical details for CVE-2007-5519 are not publicly provided in the supplied documents; affected product is Oracle Portal in Oracle Application Server 9.0.4.3 / 10.1.2.0.2 with unknown impact. Monitor for updates.

CVE-2007-5522

Technical details for CVE-2007-5522 are not publicly provided in the supplied documents. No confirmed affected products, impact, or remediation are specified here. Monitor for updates from official advisories.

CVE-2008-2583

CVE-2008-2583 affects Oracle Portal’s sample Discussion Forum Portlet (Oracle Application Server 10g). The vulnerability resides in the Discussion Forum Portlet distributed via OTN prior to 20080715, enabling remote exploitation over a network with unknown impact per the initial description, but ...

CVE-2008-2619

The CVE-2008-2619 entry describes an unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server (versions 1.0.2.2, 9.0.4.3, 10.1.2.2) and E-Business Suite 11.5.10.2. It allows remote authenticated users to affect availability via unknown vectors. The connecte...

CVE-2008-4017

Technical details for CVE-2008-4017 are not provided in the connected documents. The OC4J vulnerability in Oracle Application Server 10.1.2.3 is described as unspecified; monitor for updates from Oracle/NVD and other security advisories.

CVE-2006-3709

Technical details for CVE-2006-3709 are not provided in the supplied documents; the entry remains unspecified with unknown impact/attack vectors. Monitor for updates from official sources.

CVE-2006-5357

CVE-2006-5357 concerns an unspecified vulnerability in the Oracle HTTP Server component of Oracle Application Server (versions 10.1.2.0.1, 10.1.2.0.2, 10.1.2.1.0) with unknown impact and remote attack vectors related to the PHP Module (aka Vuln# OHS03). The connected sources confirm this CVE entr...

CVE-2006-5366

Technical details (affected components, root cause, specific impact or fixes) are not provided in the connected documents. Monitor for official advisories or vendor advisories for CVE-2006-5366 updates.

CVE-2007-5516

Technical details about CVE-2007-5516 are not provided in the supplied documents; no affected versions, impact, or remediation are specified. Monitor for updates from official advisories.

CVE-2007-5521

Technical details about CVE-2007-5521 are not provided in the connected documents. The materials show only a generic description of an unspecified vulnerability in Oracle Containers for J2EE; no product/version-specific exploits, impact, or fixes are included. Monitor for updates.

CVE-2006-3707

Technical details for CVE-2006-3707 are not publicly available in the provided documents. Monitor for updates from vendor advisories and security feeds.

CVE-2007-3862

Technical details about CVE-2007-3862 are not publicly provided in the supplied documents; monitor for updates. Available sources only note an unspecified vulnerability in Oracle Application Server via Oracle Single Sign-On.

CVE-2007-5517

Technical details for CVE-2007-5517 are not publicly available in the provided documents. Monitor for updates from vendors and advisories; the materials here do not specify affected products, root cause, impact, or remediation.

CVE-2007-5518

Technical details about CVE-2007-5518 are not publicly provided in the supplied documents. No confirmed affected products, impact, or remediation are described here. Monitor official advisories and vendor notices for updates.