Show filters
51 Total Results
Displaying 41-50 of 51
Sort by:
Attacker Value
Unknown
CVE-2002-1631
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
0
Attacker Value
Unknown
CVE-2002-1632
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
0
Attacker Value
Unknown
CVE-2002-1858
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
0
Attacker Value
Unknown
CVE-2002-2347
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.
0
Attacker Value
Unknown
CVE-2002-2345
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access.
0
Attacker Value
Unknown
CVE-2002-1630
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.
0
Attacker Value
Unknown
CVE-2002-0386
Disclosure Date: November 04, 2002 (last updated February 22, 2025)
The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a ".." (dot dot) sequence, or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.
0
Attacker Value
Unknown
CVE-2002-0843
Disclosure Date: October 11, 2002 (last updated February 22, 2025)
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
0
Attacker Value
Unknown
CVE-2002-0840
Disclosure Date: October 11, 2002 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
0
Attacker Value
Unknown
CVE-2002-0947
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long database name parameter.
0
