Oracle Application Server vulnerabilities

CVE-2007-5516 [HIGH] CVE-2007-5516: Unspecified vulnerability in the Oracle Process Mgmt & Notification component in Oracle Application Unspecified vulnerability in the Oracle Process Mgmt & Notification component in Oracle Application Server 10.1.3.3 has unknown impact and remote attack vectors, aka AS01.

CVE-2007-5524 [HIGH] CVE-2007-5524: Unspecified vulnerability in the Oracle Single Sign-On component in Oracle Application Server 9.0.4. Unspecified vulnerability in the Oracle Single Sign-On component in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS09 or AS9.

CVE-2007-5522 [HIGH] CVE-2007-5522: Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.4.1 has u Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.4.1 has unknown impact and remote attack vectors, aka AS07.

CVE-2007-5517 [HIGH] CVE-2007-5517: Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.2.0.2 and Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.2.0.2 and 10.1.4.1, and Collaboration Suite 10.1.2, has unknown impact and remote attack vectors, aka AS02.

CVE-2002-0562 [MEDIUM] CVE-2002-0562: The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP store The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.

CVE-2006-0275 [MEDIUM] CVE-2006-0275: Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0 Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the custom

CVE-2007-3854 [MEDIUM] CVE-2007-3854: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is

CVE-2005-1495 [HIGH] CVE-2005-1495: Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT st Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.

CVE-2008-7235 [MEDIUM] CVE-2008-7235: Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E- Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04.

CVE-2010-0066 [MEDIUM] CVE-2010-0066: Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Serv Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.

CVE-2009-0989 [MEDIUM] CVE-2009-0989: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2 Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0990.

CVE-2009-0990 [MEDIUM] CVE-2009-0990: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2 Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0989.

CVE-2008-7236 [MEDIUM] CVE-2008-7236: Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 a Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 and 10.1.3.1 allows remote attackers to affect integrity via unknown vectors, aka AS05.

CVE-2010-0067 [MEDIUM] CVE-2010-0067: Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 1 Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors.

CVE-2009-3407 [MEDIUM] CVE-2009-3407: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0974 and CVE-2009-0983.

CVE-2008-2609 [MEDIUM] CVE-2008-2609: Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1. Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors.

CVE-2002-1858 [MEDIUM] CVE-2002-1858: Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, all Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").

CVE-2005-2093 [MEDIUM] CVE-2005-2093: Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, byp Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way

CVE-2009-0974 [MEDIUM] CVE-2009-0974: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0983 and CVE-2009-3407.

CVE-2002-0565 [MEDIUM] CVE-2002-0565: Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.