Weekly Vulnerabilities Reports > February 4 to 10, 2002
3 new vulnerabilities reported during this period, including 0 critical vulnerabilities and 1 high severity vulnerabilities. This weekly summary report vulnerabilities in 2 products from 2 vendors including Oracle, and Adobe. Vulnerabilities are notably categorized as and "Permissions, Privileges, and Access Controls".
- 3 reported vulnerabilities are remotely exploitables.
- 3 reported vulnerabilities are exploitable by an anonymous user.
- Oracle has the most reported vulnerabilities, with 2 reported vulnerabilities.
The following table list reported vulnerabilities for the period covered by this report:
0 Critical Vulnerabilities
1 High Vulnerabilities
|2002-02-06||CVE-2001-1371||Oracle|| Permissions, Privileges, and Access Controls vulnerability in Oracle Application Server 1.0.2 |
The default configuration of Oracle Application Server 9iAS 126.96.36.199 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
2 Medium Vulnerabilities
|2002-02-09||CVE-2002-1601||Adobe|| Unspecified vulnerability in Adobe Photodeluxe 3.0/3.1/4.0 |
The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page.
|2002-02-06||CVE-2001-1372||Oracle|| Unspecified vulnerability in Oracle Application Server 1.0.2 |
Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
0 Low Vulnerabilities