Wazi » application_server http://olex.openlogic.com/wazi Thinking OPEN Fri, 06 Nov 2009 19:33:28 +0000 http://wordpress.org/?v=2.8.5 en hourly 1 Application Server 10.1.4.2 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/ Affects:
  • Application Server 10.1.4.2 and prior [Medium]

Description

Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-3407
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/feed/ 0 Application Server 10.1.3.4.1 [Low] http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/ http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/ Affects:
  • Application Server 10.1.3.4.1 [Low]

Description

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1990
Severity: Low

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/feed/ 0 Application Server [Medium] http://olex.openlogic.com/wazi/2009/application-server-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-medium-4/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-medium-4/ Affects:
  • Application Server [Medium]

Description

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1999
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-medium-4/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) standard, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; and other products uses a parameter that defines an HMAC truncation length but does not require a minimum for this length, which allows attackers to bypass HMAC protection and spoof HMAC-based signatures by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/feed/ 0 Application Server 10.1.2.3 [Medium] http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/ Affects:
  • Application Server 10.1.2.3 [Medium]

Description

Unspecified vulnerability in the HTTP Server component in Oracle Application Server 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1976
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1011
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is for multiple integer overflows in a function that parses an optional data stream within a Microsoft Office file, leading to a heap-based buffer overflow.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1011
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/feed/ 0 Application Server 10.1.3.3.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/ Affects:
  • Application Server 10.1.3.3.3 and prior [Medium]

Description

Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0989
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/feed/ 0 Application Server 10.1.3.4 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/ Affects:
  • Application Server 10.1.3.4 and prior [Medium]

Description

Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0994
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1008
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/feed/ 0 Application Server 8.1.9 [Medium] http://olex.openlogic.com/wazi/2009/application-server-819-medium/ http://olex.openlogic.com/wazi/2009/application-server-819-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-819-medium/ Affects:
  • Application Server 8.1.9 [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1009
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-819-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1010
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/feed/ 0 Application Server 10.2.0.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10200-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10200-and-prior-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10200-and-prior-medium/ Affects:
  • Application Server 10.2.0.0 and prior [Medium]

Description

Unspecified vulnerability in the Oracle BPEL Process Manager component in Oracle Application Server allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2008-4014
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10200-and-prior-medium/feed/ 0 Application Server 10.1.2.3 [Medium] http://olex.openlogic.com/wazi/2009/application-server-10123-medium/ http://olex.openlogic.com/wazi/2009/application-server-10123-medium/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10123-medium/ Affects:
  • Application Server 10.1.2.3 [Medium]

Description

Unspecified vulnerability in the OC4J component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2008-4017
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10123-medium/feed/ 0 Application Server 10.1.2.2 and prior [Low] http://olex.openlogic.com/wazi/2008/application-server-10122-and-prior-low/ http://olex.openlogic.com/wazi/2008/application-server-10122-and-prior-low/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2008/application-server-10122-and-prior-low/ Affects:
  • Application Server 10.1.2.2 and prior [Low]

Description

Unspecified vulnerability in the Oracle Discoverer Administrator component in Oracle Application Server 9.0.4.3 and 10.1.2.2 allows local users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2008-3986
Severity: Low

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2008/application-server-10122-and-prior-low/feed/ 0 Application Server 10.1.2.3 [Low] http://olex.openlogic.com/wazi/2008/application-server-10123-low/ http://olex.openlogic.com/wazi/2008/application-server-10123-low/#comments Tue, 30 Nov 1999 06:00:00 +0000 Security Team http://olex.openlogic.com/wazi/2008/application-server-10123-low/ Affects:
  • Application Server 10.1.2.3 [Low]

Description

Unspecified vulnerability in the Oracle Discoverer Desktop component in Oracle Application Server 10.1.2.3 allows local users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2008-3987
Severity: Low

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2008/application-server-10123-low/feed/ 0