Application Server

application_server

Vendor: Oracle • 198 CVEs

CVEs (198)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2002-0565 1Oracle 3Application Server Application Server Web CacheOracle9i Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including userna...Show more Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.Show less
CVE-2002-0564 1Oracle 4Application Server Application Server Web CacheOracle8i+1 more Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has...Show more PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.Show less
CVE-2002-0563 1Oracle 4Application Server Application Server Web CacheOracle8i+1 more Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) se...Show more The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.Show less
CVE-2002-0562 1Oracle 3Application Server Application Server Web CacheOracle9i Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and pa...Show more The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.Show less
CVE-2002-0561 1Oracle 4Application Server Application Server Web CacheOracle8i+1 more Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.
CVE-2002-0560 1Oracle 4Application Server Application Server Web CacheOracle8i+1 more Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 5.0 MEDIUM· v2 PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature, (2) OWA_UTIL.listprint, or (3) OWA_UTIL.s...Show more PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature, (2) OWA_UTIL.listprint, or (3) OWA_UTIL.show_query_columns.Show less
CVE-2002-0559 1Oracle 4Application Server Application Server Web CacheOracle8i+1 more Apr 16, 2026 Jul 3, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which...Show more Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long HTTP request to the plsql module, (3) a long password in the HTTP Authorization, (4) a long Access Descriptor (DAD) password in the addadd form, or (5) a long cache directory name.Show less
CVE-2002-1637 1Oracle 1Application Server Apr 16, 2026 Feb 26, 2002 N/A· v4 N/A· v3 4.6 MEDIUM· v2 Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL,...Show more Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.Show less
CVE-2001-1372 1Oracle 1Application Server Apr 16, 2026 Feb 6, 2002 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
CVE-2001-1371 1Oracle 1Application Server Apr 16, 2026 Feb 6, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
CVE-2001-1217 1Oracle 1Application Server Apr 16, 2026 Dec 21, 2001 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
CVE-2001-1216 1Oracle 1Application Server Apr 16, 2026 Dec 21, 2001 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
CVE-2001-0591 1Oracle 2Application Server Jsp Apr 16, 2026 Aug 22, 2001 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a '..' (dot dot) attack.
CVE-2001-0419 1Oracle 1Application Server Apr 16, 2026 Jul 2, 2001 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in shared library ndwfn4.so for iPlanet Web Server (iWS) 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP reque...Show more Buffer overflow in shared library ndwfn4.so for iPlanet Web Server (iWS) 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/.Show less
CVE-2001-0326 1Oracle 2Application Server Oracle8i Apr 16, 2026 May 3, 2001 N/A· v4 N/A· v3 7.5 HIGH· v2 Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configu...Show more Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.Show less
CVE-2000-1236 1Oracle 1Application Server Apr 16, 2026 Dec 31, 2000 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the query string of the URL.
CVE-2000-1235 1Oracle 1Application Server Apr 16, 2026 Dec 31, 2000 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow remote attackers to view privileged database information via HTTP requests for Data...Show more The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow remote attackers to view privileged database information via HTTP requests for Database Access Descriptor (DAD) files.Show less
CVE-2000-0169 1Oracle 1Application Server Apr 16, 2026 Mar 15, 2000 N/A· v4 N/A· v3 7.5 HIGH· v2 Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'.

Previous 1...6 7 8 910