Application Server Portal
Vendor:
First CVE: Nov 3, 2003 · Active for 22 years
6
Total CVEs
More Total CVEs than 83% of tracked products
1.2
Avg CVEs / Year
Higher CVE frequency than 58% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 25% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Application Server Portal over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 3, 2003
22 years ago
Most Recent CVE
May 12, 2008
6,651 days ago
CVE Severity & Scoring
Application Server Portal6 CVEs
50%
50%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown6 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown6 (100.0%)
User Interaction
None0 (0.0%)
Unknown6 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown6 (100.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-6697HIGH CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP | Dec 22, 2006 | 7.5 | 33 | NO | YES |
CVE-2008-2138MEDIUM Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request con | May 12, 2008 | 5.0 | 29 | NO | YES |
CVE-2004-1707HIGH The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at rais | Jul 30, 2004 | 7.2 | 28 | NO | YES |
CVE-2007-1506MEDIUM Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the (1 | Mar 19, 2007 | 4.3 | 21 | NO | YES |
CVE-2003-1193HIGH Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9 | Nov 3, 2003 | 7.5 | 19 | NO | NO |
CVE-2006-6699MEDIUM Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitti | Dec 23, 2006 | 5.0 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
66.7% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Application Server Portal
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.0.2.3b | 2 | 7.3 | 2.2% | 0 | 1 |
| 9.0.2.3a | 2 | 7.3 | 2.2% | 0 | 1 |
| 9.0.2.3 | 2 | 7.3 | 2.2% | 0 | 1 |
| 9.0.2 | 2 | 6.3 | 5.8% | 0 | 1 |
| 3.0.9.8.5 | 2 | 7.3 | 2.2% | 0 | 1 |
| 10g | 2 | 6.3 | 13.1% | 0 | 2 |