Oracle Application Server Portal vulnerabilities

6 CVEs affecting Oracle Application Server Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-2138, published 2008-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-2138, published 2008-05-12. Medium severity, CVSS 5.0. EPSS: 15.5% chance of exploitation in the next 30 days. Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing…
CVE-2006-6697, published 2006-12-22. High severity, CVSS 7.5. EPSS: 13.1% chance of exploitation in the next 30 days. CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…
CVE-2004-1707, published 2004-07-30. High severity, CVSS 7.2. EPSS: 2.6% chance of exploitation in the next 30 days. The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges,…
CVE-2007-1506, published 2007-03-19. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the (1) p_oldurl and (2)…
CVE-2003-1193, published 2003-11-03. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through…
CVE-2006-6699, published 2006-12-23. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF…