Oracle Application Server vulnerabilities

198 CVEs affecting Oracle Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1967, published 2020-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2002-0840, published 2002-10-11. Medium severity, CVSS 6.8. EPSS: 95.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows…
CVE-2002-0656, published 2002-08-12. High severity, CVSS 7.5. EPSS: 89.8% chance of exploitation in the next 30 days. Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in…
CVE-2002-0568, published 2002-07-03. Low severity, CVSS 2.1. EPSS: 75.2% chance of exploitation in the next 30 days. Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1)…
CVE-2001-1217, published 2001-12-21. Medium severity, CVSS 5.0. EPSS: 54.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot)…
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2002-0563, published 2002-07-03. Medium severity, CVSS 5.0. EPSS: 51.1% chance of exploitation in the next 30 days. The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0,…
CVE-2005-1496, published 2005-05-11. Medium severity, CVSS 4.6. EPSS: 38.3% chance of exploitation in the next 30 days. The DBMS_Scheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSION_USER to the SYS user.
CVE-2002-0659, published 2002-08-12. Medium severity, CVSS 5.0. EPSS: 36.2% chance of exploitation in the next 30 days. The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.
CVE-2005-1383, published 2005-05-03. High severity, CVSS 7.5. EPSS: 30.6% chance of exploitation in the next 30 days. The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache…
CVE-2006-0287, published 2006-01-18. High severity, CVSS 10.0. EPSS: 29% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle…

Latest

CVE-2018-5407, published 2018-11-15. Medium severity, CVSS 4.7. EPSS: 3.4% chance of exploitation in the next 30 days. Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-0735, published 2018-10-29. Medium severity, CVSS 5.9. EPSS: 4.7% chance of exploitation in the next 30 days. The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in…
CVE-2010-0070, published 2010-01-13. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect integrity via unknown vectors.
CVE-2010-0067, published 2010-01-13. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors.
CVE-2010-0066, published 2010-01-13. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.
CVE-2009-3412, published 2010-01-13. Low severity, CVSS 1.0. EPSS: 0.3% chance of exploitation in the next 30 days. Unspecified vulnerability in the Unzip component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5; and Oracle Application Server 10.1.2.3; allows local users to affect confidentiality via unknown…
CVE-2009-3407, published 2009-10-22. Medium severity, CVSS 4.3. EPSS: 2.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than…
CVE-2009-1999, published 2009-10-22. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.
CVE-2009-1990, published 2009-10-22. Low severity, CVSS 1.7. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.