CVSS: 2.6EPSS: 1%CPEs: 15EXPL: 0CVE-2004-1877
https://notcve.org/view.php?id=CVE-2004-1877
The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password. • http://marc.info/?l=bugtraq&m=108067040722235&w=2 http://www.securityfocus.com/bid/10009 https://exchange.xforce.ibmcloud.com/vulnerabilities/15676 •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2002-1632
https://notcve.org/view.php?id=CVE-2002-1632
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 https://exchange.xforce.ibmcloud.com/vulnerabilities/8665 •
CVSS: 7.5EPSS: 2%CPEs: 5EXPL: 1CVE-2002-1630
https://notcve.org/view.php?id=CVE-2002-1630
The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 https://exchange.xforce.ibmcloud.com/vulnerabilities/8664 •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2002-1631
https://notcve.org/view.php?id=CVE-2002-1631
SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 •
CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 0CVE-2002-2347
https://notcve.org/view.php?id=CVE-2002-2347
Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field. • http://otn.oracle.com/deploy/security/pdf/2002alert41rev1.pdf http://www.iss.net/security_center/static/9842.php http://www.securityfocus.com/bid/5452 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •