AS
Product
Application Server
198
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 2Low 0
Watch
Add Application Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-1369 | – | Aug 4 | The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used… Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1368 | – | Aug 4 | ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1366 | – | Aug 4 | Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA… Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1365 | – | Aug 4 | Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1364 | – | Aug 4 | Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1362 | – | Aug 4 | The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which… Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +5 more |
| CVE-2004-1707 | – | Jul 30 | The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 1.0.2.2.2; 9.0.2; 9.0.2.0.0; +6 more |
| CVE-2004-1877 | – | Mar 30 | The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 1.0.2.2.2; 9.0.2; 9.0.2.0.0; +6 more |
| CVE-2004-2134 | – | Jan 28 | Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords Affected: 9.0.2; 9.0.2.0.0; 9.0.2.0.1; 9.0.2.1; 9.0.2.2; 9.0.2.3; +1 more |
| CVE-2002-0842 | – | Mar 3 | Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g Affected: 9.0.2 |
| CVE-2002-1858 | – | Dec 31 | Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains… Affected: 1.0.2.2; 9.0.2; 9.0.2.0.0; 9.0.2.0.1 |
| CVE-2002-1636 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS) allows remote attackers to inject arbitrary web script or HTML via the… Affected: 1.0.2 |
| CVE-2002-1635 | – | Dec 31 | The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers… Affected: All versions, or not specified |
| CVE-2002-1632 | – | Dec 31 | Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp,… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2.0.0; 9.0.2.0.1 |
| CVE-2002-1631 | – | Dec 31 | SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2.0.0; 9.0.2.0.1 |
| CVE-2002-1630 | – | Dec 31 | The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2.0.0; 9.0.2.0.1 |
| CVE-2002-2347 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2 |
| CVE-2002-2345 | – | Dec 31 | Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access Affected: 9.0.2 |
| CVE-2002-2153 | – | Dec 31 | Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote attackers to execute arbitrary code Affected: 4.0.8; 4.0.8.2 |
| CVE-2002-0386 | – | Nov 4 | The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request… Affected: 9.0.2 |
| CVE-2002-0843 | – | Oct 11 | Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2; 9.0.2; 9.0.2.1 |
| CVE-2002-0840 | – | Oct 11 | Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2; 9.0.2; 9.0.2; 9.0.2.1 |
| CVE-2002-1089 | – | Oct 4 | rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in… Affected: 9.0.2 |
| CVE-2002-0947 | – | Oct 4 | Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary… Affected: 9.0.2 |
| CVE-2002-0655 | – | Aug 12 | OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2 |
| CVE-2002-0659 | – | Aug 12 | The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings Affected: 1.0.2; 1.0.2.1s; 1.0.2.2 |
| CVE-2002-0656 | – | Aug 12 | Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a… Affected: 1.0.2; 1.0.2.1s; 1.0.2.2 |
| CVE-2002-0559 | – | Jul 3 | Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long… Affected: 1.0.2 |
| CVE-2002-0569 | – | Jul 3 | Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServlet) Affected: 1.0.2 |
| CVE-2002-0568 | – | Jul 3 | Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by… Affected: 1.0.2 |
| CVE-2002-0566 | – | Jul 3 | PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an… Affected: 1.0.2 |
| CVE-2002-0565 | – | Jul 3 | Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information… Affected: 1.0.2 |
| CVE-2002-0564 | – | Jul 3 | PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to… Affected: 1.0.2 |
| CVE-2002-0563 | – | Jul 3 | The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring… Affected: 1.0.2 |
| CVE-2002-0562 | – | Jul 3 | The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain… Affected: 1.0.2 |
| CVE-2002-0561 | – | Jul 3 | The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to… Affected: 1.0.2 |
| CVE-2002-0560 | – | Jul 3 | PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature,… Affected: 1.0.2 |
| CVE-2002-1637 | – | Feb 26 | Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5)… Affected: All versions, or not specified |
| CVE-2001-1372 | – | Feb 6 | Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the… Affected: 1.0.2 |
| CVE-2001-1371 | – | Feb 6 | The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and… Affected: 1.0.2 |
| CVE-2001-1216 | – | Dec 21 | Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page Affected: 1.0.2 |
| CVE-2001-1217 | – | Dec 21 | Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL… Affected: 1.0.2 |
| CVE-2001-0591 | – | Aug 22 | Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a… Affected: 1.0.2 |
| CVE-2001-0419 | – | Jul 2 | Buffer overflow in shared library ndwfn4.so for iPlanet Web Server (iWS) 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute… Affected: 4.0.8.2 |
| CVE-2001-0326 | – | May 3 | Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp… Affected: release_1.0.2.0.1 |
| CVE-2000-1235 | – | Dec 31 | The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow remote attackers to view privileged… Affected: through 3.0.7 |
| CVE-2000-1236 | – | Dec 31 | SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the query string… Affected: through 3.0.7 |
| CVE-2000-0169 | – | Mar 15 | Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&' Affected: 4.0 |