The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote malicious users to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
oracle application server |
||
oracle application server 9.0.2 |
||
oracle application server 9.0.3.1 |
||
oracle application server 9.0.4 |
||
oracle e-business suite 11.5.4 |
||
oracle e-business suite 11.5.5 |
||
oracle enterprise manager grid control 10.1.0.2 |
||
oracle oracle10g enterprise_10.1.0.2 |
||
oracle oracle8i enterprise_8.0.6_.0.0 |
||
oracle oracle8i enterprise_8.0.6_.0.1 |
||
oracle oracle8i enterprise_8.1.7_.1.0 |
||
oracle oracle8i enterprise_8.1.7_.4 |
||
oracle oracle8i standard_8.0.6 |
||
oracle application server 9.0.2.1 |
||
oracle application server 9.0.2.2 |
||
oracle collaboration suite release_1 |
||
oracle e-business suite 11.5.1 |
||
oracle e-business suite 11.5.9 |
||
oracle enterprise manager 9 |
||
oracle oracle10g personal_9.0.4_.0 |
||
oracle oracle10g standard_10.1_.0.2 |
||
oracle oracle8i enterprise_8.1.5_.1.0 |
||
oracle oracle8i enterprise_8.1.6_.0.0 |
||
oracle oracle8i standard_8.1.6 |
||
oracle oracle8i standard_8.1.7 |
||
oracle oracle9i enterprise_9.0.1 |
||
oracle oracle9i enterprise_9.0.1.4 |
||
oracle oracle9i enterprise_9.2.0.5 |
||
oracle oracle9i personal_8.1.7 |
||
oracle oracle9i personal_9.2.0.4 |
||
oracle oracle9i personal_9.2.0.5 |
||
oracle oracle9i standard_9.0.1.5 |
||
oracle oracle9i standard_9.0.2 |
||
oracle oracle8i standard_8.1.7_.4 |
||
oracle oracle9i client_9.2.0.1 |
||
oracle oracle9i enterprise_9.2.0.1 |
||
oracle oracle9i enterprise_9.2.0.2 |
||
oracle oracle9i personal_9.0.1.5 |
||
oracle oracle9i personal_9.2 |
||
oracle oracle9i personal_9.2.0.1 |
||
oracle oracle9i standard_9.0.1 |
||
oracle oracle9i standard_9.0.1.2 |
||
oracle oracle9i standard_9.2.0.2 |
||
oracle oracle9i standard_9.2.0.3 |
||
oracle application server 9.0.2.0.0 |
||
oracle application server 9.0.2.0.1 |
||
oracle application server 9.0.4.0 |
||
oracle application server 9.0.4.1 |
||
oracle e-business suite 11.5.6 |
||
oracle e-business suite 11.5.7 |
||
oracle e-business suite 11.5.8 |
||
oracle oracle10g enterprise_9.0.4_.0 |
||
oracle oracle10g personal_10.1_.0.2 |
||
oracle oracle8i enterprise_8.1.5_.0.0 |
||
oracle oracle8i enterprise_8.1.5_.0.2 |
||
oracle oracle8i standard_8.0.6_.3 |
||
oracle oracle8i standard_8.1.5 |
||
oracle oracle9i client_9.2.0.2 |
||
oracle oracle9i enterprise_8.1.7 |
||
oracle oracle9i enterprise_9.2.0.3 |
||
oracle oracle9i enterprise_9.2.0.4 |
||
oracle oracle9i personal_9.2.0.2 |
||
oracle oracle9i personal_9.2.0.3 |
||
oracle oracle9i standard_9.0.1.3 |
||
oracle oracle9i standard_9.0.1.4 |
||
oracle oracle9i standard_9.2.0.4 |
||
oracle oracle9i standard_9.2.0.5 |
||
oracle application server 9.0.2.3 |
||
oracle application server 9.0.3 |
||
oracle e-business suite 11.5.2 |
||
oracle e-business suite 11.5.3 |
||
oracle enterprise manager 9.0.1 |
||
oracle enterprise manager database control 10.1.2 |
||
oracle oracle10g standard_9.0.4_.0 |
||
oracle oracle8i enterprise_8.0.5_.0.0 |
||
oracle oracle8i enterprise_8.1.6_.1.0 |
||
oracle oracle8i enterprise_8.1.7_.0.0 |
||
oracle oracle8i standard_8.1.7_.0.0 |
||
oracle oracle8i standard_8.1.7_.1 |
||
oracle oracle9i enterprise_9.0.1.5 |
||
oracle oracle9i enterprise_9.2.0 |
||
oracle oracle9i personal_9.0.1 |
||
oracle oracle9i personal_9.0.1.4 |
||
oracle oracle9i standard_8.1.7 |
||
oracle oracle9i standard_9.0 |
||
oracle oracle9i standard_9.2 |
||
oracle oracle9i standard_9.2.0.1 |
Vulmon