Sun One Application Server vulnerabilities

12 CVEs affecting Sun One Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2006-6276, published 2006-12-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2004-0826, published 2004-12-31. High severity, CVSS 7.5. EPSS: 22.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
CVE-2003-0413, published 2003-06-30. Medium severity, CVSS 6.8. EPSS: 6.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote…
CVE-2002-1042, published 2002-10-04. Medium severity, CVSS 5.0. EPSS: 3.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read…
CVE-2006-6276, published 2006-12-04. Medium severity, CVSS 6.8. EPSS: 3.6% chance of exploitation in the next 30 days. HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to…
CVE-2006-2501, published 2006-05-20. Medium severity, CVSS 6.8. EPSS: 3.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and…
CVE-2002-0387, published 2003-03-18. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows remote attackers to execute arbitrary code via a long HTTP request URL.
CVE-2006-5654, published 2006-11-03. Medium severity, CVSS 4.0. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3, when SSLv2 is enabled, allows remote…
CVE-2006-3225, published 2006-06-26. Low severity, CVSS 2.6. EPSS: 2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Sun ONE Application Server 7 before Update 9, Java System Application Server 7 2004Q2 before Update 5, and Java System Application Server Enterprise…
CVE-2003-0412, published 2003-06-30. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. Sun ONE Application Server 7.0 for Windows 2000/XP does not log the complete URI of a long HTTP request, which could allow remote attackers to hide malicious activities.
CVE-2005-4046, published 2005-12-07. Medium severity, CVSS 4.0. EPSS: 1.7% chance of exploitation in the next 30 days. Unspecified vulnerability in Reverse SSL Proxy Plug-in for Sun Java System Application Server Standard Edition 7 2004Q2, Application Server Enterprise Edition 8.1 2005Q1, and Sun ONE Application…

Latest

CVE-2004-1815, published 2004-03-15. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service (memory…
CVE-2003-0414, published 2003-06-30. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. The installation of Sun ONE Application Server 7.0 for Windows 2000/XP creates a statefile with world-readable permissions, which allows local users to gain privileges by reading a plaintext password…