CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2002-1632
https://notcve.org/view.php?id=CVE-2002-1632
Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 https://exchange.xforce.ibmcloud.com/vulnerabilities/8665 •
CVSS: 7.5EPSS: 2%CPEs: 5EXPL: 1CVE-2002-1630
https://notcve.org/view.php?id=CVE-2002-1630
The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 https://exchange.xforce.ibmcloud.com/vulnerabilities/8664 •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2002-1631
https://notcve.org/view.php?id=CVE-2002-1631
SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter. • http://www.kb.cert.org/vuls/id/717827 http://www.kb.cert.org/vuls/id/SVIM-576QLZ http://www.nextgenss.com/papers/hpoas.pdf http://www.oracle.com/technology/deploy/security/pdf/ias_modplsql_alert.pdf http://www.securityfocus.com/bid/6556 •
CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 0CVE-2002-2347
https://notcve.org/view.php?id=CVE-2002-2347
Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field. • http://otn.oracle.com/deploy/security/pdf/2002alert41rev1.pdf http://www.iss.net/security_center/static/9842.php http://www.securityfocus.com/bid/5452 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 4EXPL: 0CVE-2002-1858
https://notcve.org/view.php?id=CVE-2002-1858
Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF."). • http://online.securityfocus.com/archive/1/279582 http://otn.oracle.com/deploy/security/pdf/2002alert47rev1.pdf http://www.iss.net/security_center/static/9446.php http://www.securityfocus.com/bid/5119 http://www.westpoint.ltd.uk/advisories/wp-02-0002.txt •