Wazi » application_server http://olex.openlogic.com/wazi Thinking OPEN Wed, 10 Mar 2010 23:48:24 +0000 http://wordpress.org/?v=2.9.1 en hourly 1 Application Server 10.1.3.4 and prior [Medium] http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium-2/ http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium-2/#comments Wed, 13 Jan 2010 03:30:01 +0000 Security Team http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium-2/ Affects:
  • Application Server 10.1.3.4 and prior [Medium]

Description

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2010-0070
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium-2/feed/ 0 Application Server 10.1.2.3 and prior [Low] http://olex.openlogic.com/wazi/2010/application-server-10-1-2-3-and-prior-low/ http://olex.openlogic.com/wazi/2010/application-server-10-1-2-3-and-prior-low/#comments Wed, 13 Jan 2010 03:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2010/application-server-10-1-2-3-and-prior-low/ Affects:
  • Application Server 10.1.2.3 and prior [Low]

Description

Unspecified vulnerability in the Unzip component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5; and Oracle Application Server 10.1.2.3; allows local users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-3412
Severity: Low

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2010/application-server-10-1-2-3-and-prior-low/feed/ 0 Application Server 10.1.4.2 and prior [Medium] http://olex.openlogic.com/wazi/2010/application-server-10-1-4-2-and-prior-medium-2/ http://olex.openlogic.com/wazi/2010/application-server-10-1-4-2-and-prior-medium-2/#comments Wed, 13 Jan 2010 03:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2010/application-server-10-1-4-2-and-prior-medium-2/ Affects:
  • Application Server 10.1.4.2 and prior [Medium]

Description

Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2010-0066
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2010/application-server-10-1-4-2-and-prior-medium-2/feed/ 0 Application Server 10.1.3.4 and prior [Medium] http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium/ http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium/#comments Wed, 13 Jan 2010 03:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium/ Affects:
  • Application Server 10.1.3.4 and prior [Medium]

Description

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2010-0067
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2010/application-server-10-1-3-4-and-prior-medium/feed/ 0 Application Server 10.1.4.2 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/#comments Thu, 22 Oct 2009 21:30:01 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/ Affects:
  • Application Server 10.1.4.2 and prior [Medium]

Description

Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-3407
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-1-4-2-and-prior-medium/feed/ 0 Application Server 10.1.3.4.1 [Low] http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/ http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/#comments Thu, 22 Oct 2009 21:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/ Affects:
  • Application Server 10.1.3.4.1 [Low]

Description

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1990
Severity: Low

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-1-3-4-1-low/feed/ 0 Application Server [Medium] http://olex.openlogic.com/wazi/2009/application-server-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-medium-4/#comments Thu, 22 Oct 2009 21:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-medium-4/ Affects:
  • Application Server [Medium]

Description

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1999
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-medium-4/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) standard, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; and other products uses a parameter that defines an HMAC truncation length but does not require a minimum for this length, which allows attackers to bypass HMAC protection and spoof HMAC-based signatures by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium/feed/ 0 Application Server 10.1.2.3 [Medium] http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/ Affects:
  • Application Server 10.1.2.3 [Medium]

Description

Unspecified vulnerability in the HTTP Server component in Oracle Application Server 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1976
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10123-medium-2/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-2/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-3/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-103-and-prior-medium-4/feed/ 0 Application Server 10.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/#comments Wed, 15 Jul 2009 02:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/ Affects:
  • Application Server 10.3 and prior [Medium]

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0217
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10-3-and-prior-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/#comments Wed, 15 Apr 2009 13:30:01 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1011
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-3/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/#comments Wed, 15 Apr 2009 13:30:01 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is for multiple integer overflows in a function that parses an optional data stream within a Microsoft Office file, leading to a heap-based buffer overflow.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1011
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-4/feed/ 0 Application Server 10.1.3.3.3 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/#comments Wed, 15 Apr 2009 13:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/ Affects:
  • Application Server 10.1.3.3.3 and prior [Medium]

Description

Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0989
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-101333-and-prior-medium/feed/ 0 Application Server 10.1.3.4 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/#comments Wed, 15 Apr 2009 13:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/ Affects:
  • Application Server 10.1.3.4 and prior [Medium]

Description

Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-0994
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-10134-and-prior-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/#comments Wed, 15 Apr 2009 13:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1008
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium/feed/ 0 Application Server 8.1.9 [Medium] http://olex.openlogic.com/wazi/2009/application-server-819-medium/ http://olex.openlogic.com/wazi/2009/application-server-819-medium/#comments Wed, 15 Apr 2009 13:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-819-medium/ Affects:
  • Application Server 8.1.9 [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1009
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-819-medium/feed/ 0 Application Server 8.3.0 and prior [Medium] http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/ http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/#comments Wed, 15 Apr 2009 13:30:00 +0000 Security Team http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/ Affects:
  • Application Server 8.3.0 and prior [Medium]

Description

Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.

If you have questions about this security warning or need to have it translated and you have an active technical support contract, please call 1-888-OPENLOGIC or email us at support@openlogic.com.

CVE Identifier: CVE-2009-1010
Severity: Medium

National Vulnerabilities Database

NIST National Vulnerabilities Database

]]> http://olex.openlogic.com/wazi/2009/application-server-830-and-prior-medium-2/feed/ 0