← Back

Application Server

application_server

Vendor: Oracle • 198 CVEs

CVEs (198)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2005-2093
1Oracle
1Application Server
Apr 16, 2026
Jul 5, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chu...Show more
Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."Show less
CVE-2005-1496
1Oracle
2Application Server
Oracle10g
Apr 16, 2026
May 11, 2005
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The DBMS_Scheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSION_USER to the SYS user.
CVE-2005-1495
1Oracle
3Application Server
Oracle10gOracle9i
Apr 16, 2026
May 11, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.
CVE-2005-1383
1Oracle
1Application Server
Apr 16, 2026
May 3, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.
CVE-2004-2244
1Oracle
2Application Server
Oracle9i
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a...Show more
The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service (CPU and memory consumption) via a SOAP message containing a crafted DTD.Show less
CVE-2004-1774
1Oracle
2Application Server
Oracle10g
Apr 16, 2026
Aug 31, 2004
N/A· v4
N/A· v3
7.2 HIGH· v2
Buffer overflow in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2 allows local users to execute arbitrary code via a long LAYER parameter.
CVE-2004-1371
1Oracle
10Application Server
Collaboration SuiteDatabase Server+7 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
9.0 HIGH· v2
Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure.
CVE-2004-1370
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2...Show more
Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2) WK_ACL.GET_ACL, (3) WK_ACL.STORE_ACL, (4) WK_ADM.COMPLETE_ACL_SNAPSHOT, (5) WK_ACL.DELETE_ACLS_WITH_STATEMENT, or (6) DRILOAD.VALIDATE_STMT.Show less
CVE-2004-1369
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used as an invalid offset for a pointer that r...Show more
The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used as an invalid offset for a pointer that references incorrect memory.Show less
CVE-2004-1368
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
7.8 HIGH· v2
ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.
CVE-2004-1367
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
4.4 MEDIUM· v2
Oracle 10g Database Server, when installed with a password that contains an exclamation point ("!") for the (1) DBSNMP or (2) SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.lo...Show more
Oracle 10g Database Server, when installed with a password that contains an exclamation point ("!") for the (1) DBSNMP or (2) SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.log file, which could allow local users to obtain that password and use it against SYS or SYSTEM accounts, which may have been installed with the same password.Show less
CVE-2004-1366
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
4.6 MEDIUM· v2
Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.
CVE-2004-1365
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
4.6 MEDIUM· v2
Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.
CVE-2004-1364
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
8.5 HIGH· v2
Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.
CVE-2004-1363
1Oracle
7Application Server
Collaboration SuiteDatabase Server+4 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
9.8 CRITICAL· v3
7.2 HIGH· v2
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.
CVE-2004-1362
1Oracle
9Application Server
Collaboration SuiteE Business Suite+6 more
Apr 16, 2026
Aug 4, 2004
N/A· v4
N/A· v3
7.5 HIGH· v2
The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access re...Show more
The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.Show less
CVE-2004-1707
1Oracle
5Application Server
Application Server PortalDatabase Server Lite+2 more
Apr 16, 2026
Jul 30, 2004
N/A· v4
N/A· v3
7.2 HIGH· v2
The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Orac...Show more
The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0.Show less
CVE-2004-1877
1Oracle
2Application Server
Http Server
Apr 16, 2026
Mar 30, 2004
N/A· v4
N/A· v3
2.6 LOW· v2
The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could...Show more
The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.Show less
CVE-2004-2134
1Oracle
1Application Server
Apr 16, 2026
Jan 28, 2004
N/A· v4
N/A· v3
4.6 MEDIUM· v2
Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.
CVE-2002-0842
1Oracle
1Application Server
Apr 16, 2026
Mar 3, 2003
N/A· v4
N/A· v3
7.5 HIGH· v2
Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination UR...Show more
Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string specifiers to be returned from dav_lookup_uri() in mod_dav.c, which is then used in a call to ap_log_rerror().Show less