CVSS: 5.0EPSS: 51%CPEs: 8EXPL: 1CVE-2013-3827 – Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access
https://notcve.org/view.php?id=CVE-2013-3827
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container. Vulnerabilidad no especificada en el componente de Oracle GlassFish Server en Oracle Fusion Middleware 2.1.1, 3.0.1 y 3.1.2, el componente de Oracle JDeveloper de Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0 y 12.1.2.0. 0, y el componente de Oracle WebLogic Server en Oracle Fusion Middleware 10.3.6.0 y 12.1.1 que permite a atacantes remotos afectar la confidencialidad a través de vectores desconocidos relacionados con Java Server Faces o el Web Container. • https://www.exploit-db.com/exploits/38802 http://rhn.redhat.com/errata/RHSA-2014-0029.html http://www.kb.cert.org/vuls/id/526012 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html http://www.securityfocus.com/bid/63052 http://www.securitytracker.com/id/1029190 https://access.redhat.com/security/cve/CVE-2013-3827 https://bugzilla.redhat.com/show_bug.cgi?id=1038898 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 6%CPEs: 2EXPL: 0CVE-2013-3764 – Oracle Endeca Server attachDataStore SOAP Request Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3764
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3763. Vulnerabilidad sin especificar en el componente Oracle Endeca Server en Oracle Fusion Middleware 7.4.0 y7.5.1.1, permite a usuarios autenticados remotamente comprometer la confidencialidad e integridad a través de vectores desconocidos. Vulnerabilidad distinta de CVE-2013-3763. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Endeca Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of requests to the controlSoapBinding web service. • http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html http://www.securitytracker.com/id/1028801 •
CVSS: 6.4EPSS: 97%CPEs: 2EXPL: 1CVE-2013-3763 – Oracle Endeca Server createDataStore SOAP Request Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3763
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764. Vulnerabilidad no especificada en el componente Oracle Endeca Server en Oracle Fusion Middleware v7.4.0 y v7.5.1.1 permite a atacantes remotos afectar la confidencialidad e integridad mediante vectores desconocidos, una vulnerabilidad diferente a CVE-2013-3764. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Endeca Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of requests to the controlSoapBinding web service. This service exposes the createDataStore method which contains a flaw that allows attackers to inject arbitrary operating system commands. • https://www.exploit-db.com/exploits/27877 http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html http://www.securitytracker.com/id/1028801 http://www.zerodayinitiative.com/advisories/ZDI-13-190 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2013-1529
https://notcve.org/view.php?id=CVE-2013-1529
Unspecified vulnerability in the Oracle WebCenter Interaction component in Oracle Fusion Middleware 6.5.1 and 10.3.3.0 allows remote attackers to affect integrity via unknown vectors related to Image Service. Vulnerabilidad no especificada en el componente Oracle WebCenter Interaction en Oracle Fusion Middleware v6.5.1 y v10.3.3.0 permite a atacantes remotos afectar a la integridad a través de vectores desconocidos relacionados con el servicio de Image Service. • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html •
CVSS: 4.3EPSS: 0%CPEs: 46EXPL: 0CVE-2012-1677
https://notcve.org/view.php?id=CVE-2012-1677
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via unknown vectors. Vulnerabilidad no especificada en el componente Oracle Application Server Single Sign-On en Oracle Fusion Middleware permite a atacantes remotos afectar a la integridad a través de vectores desconocidos. • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html •