Weekly Vulnerabilities Reports > February 4 to 10, 2002

Overview

3 new vulnerabilities reported during this period, including 0 critical vulnerabilities and 1 high severity vulnerabilities. This weekly summary report vulnerabilities in 2 products from 2 vendors including Oracle, and Adobe. Vulnerabilities are notably categorized as and "Permissions, Privileges, and Access Controls".

  • 3 reported vulnerabilities are remotely exploitables.
  • 3 reported vulnerabilities are exploitable by an anonymous user.
  • Oracle has the most reported vulnerabilities, with 2 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

0 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

1 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-02-06 CVE-2001-1371 Oracle Permissions, Privileges, and Access Controls vulnerability in Oracle Application Server 1.0.2

The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
7.5

2 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-02-09 CVE-2002-1601 Adobe Unspecified vulnerability in Adobe Photodeluxe 3.0/3.1/4.0

The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page.
5.1
2002-02-06 CVE-2001-1372 Oracle Unspecified vulnerability in Oracle Application Server 1.0.2

Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
5.0

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS