CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2609
https://notcve.org/view.php?id=CVE-2008-2609
Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors. Vulnerabilidad no especificada en el componente Oracle Portal de Oracle Application Server 9.0.4.3, 10.1.2.3 y 10.1.4.2 tiene impacto desconocido y vectores de ataque remotos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2008-2612
https://notcve.org/view.php?id=CVE-2008-2612
Unspecified vulnerability in the Hyperion BI Plus component in Oracle Application Server 8.3.2.4, 8.5.0.3, 9.2.0.3, 9.2.1.0, and 9.3.1.0 has unknown impact and remote attack vectors. Vulnerabilidad no especificada en el componente Hyperion BI Plus de Oracle Application Server 8.3.2.4, 8.5.0.3, 9.2.0.3, 9.2.1.0 y 9.3.1.0 tiene impacto desconocido y vectores de ataque remotos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2614
https://notcve.org/view.php?id=CVE-2008-2614
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.3.3 has unknown impact and remote attack vectors. Vulnerabilidad no especificada en el componente Oracle HTTP Server de Oracle Application Server 9.0.4.3, 10.1.2.3, y 10.1.3.3 tiene un impacto desconocido y vectores de ataque remotos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 7CVE-2008-2751 – GlassFish Application Server - '/Applications/lifecycleModulesNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-2751
Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en la interfaz webadmin de Glassfish en Java System Application Server de Sun versión 9.1_01, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, o (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc en (a) el archivo resourceNode/customResourceNew.jsf; el parámetro (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, o (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc en (b) el archivo resourceNode/externalResourceNew.jsf; el parámetro (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, o (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc en (c) el archivo resourceNode/jmsDestinationNew.jsf; el parámetro (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi o (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd en (d) el archivo resourceNode/jmsConnectionNew.jsf; el parámetro (15) propertyForm:propertySheet:propertSectionTextField :jndiProp:jnditext o (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc en (e) el archivo resourceNode/jdbcResourceNew.jsf; el parámetro (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, o (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder en (f) el archivo aplicaciones/lifecycleModulesNew.jsf; o el parámetro (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, o (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db en (g) el archivo resourceNode/jdbcConnectionPoolNew1.jsf. • https://www.exploit-db.com/exploits/31927 https://www.exploit-db.com/exploits/31922 https://www.exploit-db.com/exploits/31923 https://www.exploit-db.com/exploits/31928 https://www.exploit-db.com/exploits/31926 https://www.exploit-db.com/exploits/31925 https://www.exploit-db.com/exploits/31924 http://securityreason.com/securityalert/3949 http://www.securityfocus.com/archive/1/493370/100/0/threaded http://www.securityfocus.com/bid/29751 https://exchange.xforce.ibmcloud • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 90%CPEs: 1EXPL: 2CVE-2008-2138 – Oracle Application Server Portal 10g - Authentication Bypass
https://notcve.org/view.php?id=CVE-2008-2138
Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing "%0A" (encoded line feed), then using the session ID that is generated from that request. NOTE: as of 20080512, Oracle has not commented on the accuracy of this report. Oracle Application Server (OracleAS) Portal 10g permite a atacantes remotos evitar las restricciones de acceso previstas y leer los contenidos de /dav_portal/portal/ mediante una petición que contiene un rastro "%0A" (avance de línea codificado) y utilizando a continuación el ID de sesión que se genera de esa petición. NOTA: a fecha del 12-05-2008, Oracle no ha comentado la exactitud de este repote • https://www.exploit-db.com/exploits/31770 http://secunia.com/advisories/30140 http://securityreason.com/securityalert/3867 http://www.securityfocus.com/archive/1/491865/100/0/threaded http://www.securityfocus.com/bid/29119 http://www.securitytracker.com/id?1020034 https://exchange.xforce.ibmcloud.com/vulnerabilities/42302 • CWE-264: Permissions, Privileges, and Access Controls •