[ {"cve_id":"CVE-2010-4265","description":"The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.","exploit_maturity":"No public exploit","published":"2010-12-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Low"}, {"cve_id":"CVE-2010-3878","description":"Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files.","exploit_maturity":"No public exploit","published":"2010-12-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-3862","description":"The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.","exploit_maturity":"No public exploit","published":"2010-12-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Low"}, {"cve_id":"CVE-2010-3708","description":"The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.","exploit_maturity":"No public exploit","published":"2010-12-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"}, {"cve_id":"CVE-2010-3860","description":"IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.","exploit_maturity":"No public exploit","published":"2010-12-08","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-4408","description":"Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.","exploit_maturity":"No public exploit","published":"2010-12-06","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-4312","description":"The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.","exploit_maturity":"No public exploit","published":"2010-11-26","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-4172","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.","exploit_maturity":"Working exploit published","published":"2010-11-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-4220","description":"Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to \"URL injection.\"","exploit_maturity":"No public exploit","published":"2010-11-09","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0786","description":"The Web Services Security component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 does not properly implement the Java API for XML Web Services (aka JAX-WS), which allows remote attackers to cause a denial of service (data corruption) via a crafted JAX-WS request that leads to incorrectly encoded data.","exploit_maturity":"No public exploit","published":"2010-11-09","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0785","description":"Cross-site request forgery (CSRF) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-11-09","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0784","description":"Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"No public exploit","published":"2010-11-09","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0783","description":"Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"No public exploit","published":"2010-11-09","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3863","description":"Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.","exploit_maturity":"Working exploit published","published":"2010-11-05","resolved":"MITIGATED-BY-RASP","severity":"Medium"}, {"cve_id":"CVE-2010-3700","description":"VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.","exploit_maturity":"No public exploit","published":"2010-10-29","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-4007","description":"Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.","exploit_maturity":"No public exploit","published":"2010-10-20","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-2057","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","exploit_maturity":"No public exploit","published":"2010-10-20","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-3574","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3573","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3572","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3571","description":"Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3570","description":"Unspecified vulnerability in the Deployment Toolkit component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3569","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3568","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3567","description":"Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to a calculation error in right-to-left text character counts for the ICU OpenType font rendering implementation, which triggers an out-of-bounds memory access.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3565","description":"Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3563","description":"Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to \"how Web Start retrieves security policies,\" BasicServiceImpl, and forged policies that bypass sandbox restrictions.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3562","description":"Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3561","description":"Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3560","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Low"}, {"cve_id":"CVE-2010-3558","description":"Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3557","description":"Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to the modification of \"behavior and state of certain JDK classes\" and \"mutable static.\"","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3556","description":"Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-3555","description":"Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle, which allows attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3554","description":"Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to \"permissions granted to certain system objects.\"","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3553","description":"Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to unsafe reflection involving the UIDefault.ProxyLazyValue class.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3552","description":"Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3551","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3550","description":"Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-3549","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3548","description":"Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or \"otherwise-protected internal network names.\"","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3541","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.","exploit_maturity":"No public exploit","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-3581","description":"Unspecified vulnerability in the BPEL Console component in Oracle Fusion Middleware 11.1.1.1.0 and 11.1.1.2.0 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-10-14","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2010-3547","description":"Unspecified vulnerability in the PeopleSoft FMS ESA - EX component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3539","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS - GL component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2010-3538.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3538","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS - GL component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2010-3539.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3537","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS - AM component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3536","description":"Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3534","description":"Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 6.21.3.0 and 7.0.1.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Project Management Module.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3533","description":"Unspecified vulnerability in the PeopleSoft Enterprise SCM OM and CRM Order Capture component in Oracle PeopleSoft and JDEdwards Suite 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3532","description":"Unspecified vulnerability in the PeopleSoft Enterprise CRM - Order Capture component in Oracle PeopleSoft and JDEdwards Suite 9.0 Bundle #28 and 9.1 Bundle #4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3531","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS ESA - RM component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3530","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM - HR component in Oracle PeopleSoft and JDEdwards Suite 9.0 Bundle #13 and 9.1 Bundle #3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3529","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS - Cash Management component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3528","description":"Unspecified vulnerability in the PeopleSoft Enterprise CRM - Common Components component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #41, 9.0 Bundle #28, and 9.1 Bundle #4 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3527","description":"Unspecified vulnerability in the PeopleSoft Enterprise FMS - AM component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect integrity and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3526","description":"Unspecified vulnerability in the PeopleSoft Enterprise SCM - PO component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3525","description":"Unspecified vulnerability in the (1) PeopleSoft Enterprise FMS, (2) SCM, (3) EPM, (4) CRM, and (5) Campus Solutions components in Oracle PeopleSoft and JDEdwards Suite 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3524","description":"Unspecified vulnerability in the PeopleSoft Enterprise SCM - Strategic Sourcing component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3523","description":"Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.28 and 8.50.12 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3522","description":"Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.28 and 8.50.12 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3521","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM ePay component in Oracle PeopleSoft and JDEdwards Suite 9.0 to Payroll Update 10-C and 9.1 to Payroll Update 10-C allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3520","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM - GP France component in Oracle PeopleSoft and JDEdwards Suite 8.81 SP1 Bundle #12, 8.9 GP Update 2010-E, 9.0 GP Update 2010-E, and 9.1 GP Update 2010-E allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3519","description":"Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.28 and 8.50.12 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3518","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM GP - Japan component in Oracle PeopleSoft and JDEdwards Suite 8.81 SP1 Bundle #13, 8.9 GP Update 2010-E, 9.0 GP Update 2010-E, and 9.1 GP Update 2010-E allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3504","description":"Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3502","description":"Unspecified vulnerability in the Siebel Core component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3501","description":"Unspecified vulnerability in the OID component in Oracle Fusion Middleware 10.1.2.3, 10.1.4.3, and 11.1.1.2.0 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3500","description":"Unspecified vulnerability in the Siebel Core - Highly Interactive Client component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-2405.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2418","description":"Unspecified vulnerability in the Oracle Territory Management component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2417","description":"Unspecified vulnerability in the Agile PLM component in Oracle Supply Chain Products Suite 9.3.0.0 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2416","description":"Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2413","description":"Unspecified vulnerability in the BI Publisher component in Oracle Fusion Middleware 10.1.3.3.2 and 10.1.3.4.1 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2410","description":"Unspecified vulnerability in the Cabo/UIX component in Oracle Fusion Middleware 10.1.2.3 and 10.1.3.5 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2395 and CVE-2010-2409.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2409","description":"Unspecified vulnerability in the Cabo/UIX component in Oracle Fusion Middleware 10.1.2.3 and 10.1.3.5 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2395 and CVE-2010-2410.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2408","description":"Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2406","description":"Unspecified vulnerability in the Siebel Core - Highly Interactive Client component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2405","description":"Unspecified vulnerability in the Siebel Core - Highly Interactive Client component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-3500.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2404","description":"Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect integrity via unknown vectors related to Account.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-2396","description":"Unspecified vulnerability in the Forms component in Oracle Fusion Middleware 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2395","description":"Unspecified vulnerability in the Cabo/UIX component in Oracle Fusion Middleware 10.1.2.3 and 10.1.3.5 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2409 and CVE-2010-2410.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2388","description":"Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-10-14","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0781","description":"Unspecified vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted URL.","exploit_maturity":"No public exploit","published":"2010-09-21","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-3186","description":"IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is used, does not properly handle an IncludeTimestamp setting in the WS-Security policy, which has unspecified impact and remote attack vectors.","exploit_maturity":"No public exploit","published":"2010-08-30","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-2076","description":"Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.","exploit_maturity":"No public exploit","published":"2010-08-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"}, {"cve_id":"CVE-2010-1870","description":"The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.","exploit_maturity":"Working exploit published","published":"2010-08-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-3737","description":"The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method, which allows remote attackers to execute arbitrary code via a crafted HTML document.","exploit_maturity":"No public exploit","published":"2010-08-17","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2009-4269","description":"The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.","exploit_maturity":"No public exploit","published":"2010-08-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Low"}, {"cve_id":"CVE-2010-2493","description":"The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.","exploit_maturity":"No public exploit","published":"2010-08-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-2474","description":"JBoss Enterprise Service Bus (ESB) before 4.7 CP02 in JBoss Enterprise SOA Platform before 5.0.2 does not properly consider the security domain with which a service is secured, which might allow remote attackers to gain privileges by executing a service.","exploit_maturity":"No public exploit","published":"2010-08-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Low"}, {"cve_id":"CVE-2010-1871","description":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","exploit_maturity":"Exploited in the wild","published":"2010-08-05","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2009-2696","description":"Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to \"invalid HTML.\" NOTE: this is due to a missing fix for CVE-2009-0781.","exploit_maturity":"No public exploit","published":"2010-08-05","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-2403","description":"Unspecified vulnerability in the PeopleSoft Enterprise Campus Solutions component in Oracle PeopleSoft and JDEdwards Suite Campus Solutions 9.0 Bundle #17 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-2402","description":"Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.27 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2401","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile Mgr component in Oracle PeopleSoft and JDEdwards Suite HCM 9.0 Bundle #9 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2398","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft and JDEdwards Suite HCM 9.0 Bundle #12 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2381","description":"Unspecified vulnerability in the Application Server Control component in Oracle Fusion Middleware 10.1.2.3 and 10.1.4.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2010-0081.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-2380","description":"Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft and JDEdwards Suite SCM 8.9 Bundle #37, SCM 9.0 Bundle #30, and SCM 9.1 Bundle #4 allows local users to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2379","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM - Time \u0026 Labor component in Oracle PeopleSoft and JDEdwards Suite HCM 9.0 Bundle #13 and HCM 9.1 Bundle #2 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2378","description":"Unspecified vulnerability in the PeopleSoft Enterprise CRM component in Oracle PeopleSoft and JDEdwards Suite CRM 9.0 Bundle #28 and CRM 9.1 Bundle #4 allows local users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-2377","description":"Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.27 and 8.50.10 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2375","description":"Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-2373","description":"Unspecified vulnerability in the Console component in Oracle Enterprise Manager Grid Control 10.1.0.6 and 10.2.0.5 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2372","description":"Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1.1 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2371.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2371","description":"Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1.1 allows local users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-2372.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-2370","description":"Unspecified vulnerability in the Oracle Business Process Management component in Oracle Fusion Middleware 5.7 MP3, 6.0 MP5, and 10.3 MP2 allows remote attackers to affect integrity, related to BPM.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-2227","description":"Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with \"recycling of a buffer.\"","exploit_maturity":"Forecast only","published":"2010-07-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-0915","description":"Unspecified vulnerability in the Oracle Advanced Product Catalog component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0913","description":"Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0912","description":"Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0909","description":"Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0908","description":"Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0905","description":"Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 and 12.0.4 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0836","description":"Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0835","description":"Unspecified vulnerability in the Wireless component in Oracle Fusion Middleware 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0081","description":"Unspecified vulnerability in the Application Server Control component in Oracle Fusion Middleware 10.1.2.3 and 10.1.4.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2381.","exploit_maturity":"No public exploit","published":"2010-07-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0779","description":"Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"No public exploit","published":"2010-06-24","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0778","description":"Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"No public exploit","published":"2010-06-24","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-1632","description":"Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.","exploit_maturity":"No public exploit","published":"2010-06-22","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"}, {"cve_id":"CVE-2010-1622","description":"SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.","exploit_maturity":"Working exploit published","published":"2010-06-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"}, {"cve_id":"CVE-2010-2328","description":"The HTTP Channel in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (NullPointerException) via a large amount of chunked data that uses gzip compression.","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2327","description":"mod_ibm_ssl in IBM HTTP Server 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11, as used in IBM WebSphere Application Server (WAS) on z/OS, does not properly handle a large HTTP request body in uploading over SSL, which might allow remote attackers to cause a denial of service (daemon fail) via an upload.","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2326","description":"IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about CIMMetadataCollectorImpl trace actions by reading the addNode.log file.","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2325","description":"Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to \"URL injection.\"","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2324","description":"IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS allows attackers to perform unspecified \"link injection\" actions via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-2323","description":"IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated with profile creation by the BBOWWPFx job and the zPMT.","exploit_maturity":"No public exploit","published":"2010-06-18","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2274","description":"Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.","exploit_maturity":"No public exploit","published":"2010-06-15","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-2103","description":"Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-05-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-2087","description":"Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.","exploit_maturity":"No public exploit","published":"2010-05-27","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-2086","description":"Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.","exploit_maturity":"No public exploit","published":"2010-05-27","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-0777","description":"The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle long filenames and consequently sends an incorrect file in some responses, which allows remote attackers to obtain sensitive information by reading the retrieved file.","exploit_maturity":"No public exploit","published":"2010-05-17","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0776","description":"The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle chunked transfer encoding during a call to response.sendRedirect, which allows remote attackers to cause a denial of service via a GET request.","exploit_maturity":"No public exploit","published":"2010-05-17","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0775","description":"Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a crafted request, related to the nodeagent and Deployment Manager components.","exploit_maturity":"No public exploit","published":"2010-05-17","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0774","description":"The (1) JAX-RPC WS-Security 1.0 and (2) JAX-WS runtime implementations in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 do not properly handle WebServices PKCS#7 and PKIPath tokens, which allows remote attackers to bypass intended access restrictions via unspecified vectors.","exploit_maturity":"No public exploit","published":"2010-05-17","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-1651","description":"IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and SIP tracing (aka full trace logging for SIP) are enabled, logs the entirety of all inbound and outbound SIP messages, which allows local users to obtain sensitive information by reading the trace log.","exploit_maturity":"No public exploit","published":"2010-05-03","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-1650","description":"IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.41, 6.1.x before 6.1.0.31, and 7.0.x before 7.0.0.11, when the -trace option (aka debugging mode) is enabled, executes debugging statements that print string representations of unspecified objects, which allows attackers to obtain sensitive information by reading the trace output.","exploit_maturity":"No public exploit","published":"2010-05-03","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-1587","description":"The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.","exploit_maturity":"Working exploit published","published":"2010-04-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-0738","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","exploit_maturity":"Exploited in the wild","published":"2010-04-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-1157","description":"Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.","exploit_maturity":"Working exploit published","published":"2010-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2010-0887","description":"Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-20","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0886","description":"Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-04-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-1423","description":"Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"}, {"cve_id":"CVE-2010-0073","description":"Unspecified vulnerability in the WebLogic Server in Oracle WebLogic Server 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, and 10.3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-14","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0880","description":"Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.26 and 8.50.07 allows remote attackers to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0879","description":"Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.26 and 8.50.07 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0878","description":"Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.26 and 8.50.07 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0877","description":"Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.26 and 8.50.07 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0876","description":"Unspecified vulnerability in the Life Sciences - Oracle Clinical Remote Data Capture Option component in Oracle Industry Product Suite 4.5.3 and 4.6 allows remote attackers to affect integrity, related to RDC Onsite.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0875","description":"Unspecified vulnerability in the Life Sciences - Oracle Thesaurus Management System component in Oracle Industry Product Suite 4.5.2, 4.6, and 4.6.1 allows remote attackers to affect integrity, related to TMS Browser.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0874","description":"Unspecified vulnerability in the Communications - Oracle Communications Unified Inventory Management component in Oracle Industry Product Suite 7.1 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0872","description":"Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 10.1.2.3 and 10.1.4.3 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0871","description":"Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0869","description":"Unspecified vulnerability in the Oracle Transportation Management component in Oracle E-Business Suite 5.5.05.07, 5.5.06.00, and 6.0.03 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0868","description":"Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0865","description":"Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle E-Business Suite 6.1.1.0 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0864","description":"Unspecified vulnerability in the Retail - Oracle Retail Place In-Season component in Oracle Industry Product Suite 12.2 allows remote attackers to affect integrity via unknown vectors related to Online Help.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0863","description":"Unspecified vulnerability in the Retail - Oracle Retail Plan In-Season component in Oracle Industry Product Suite 12.2 allows remote attackers to affect integrity via unknown vectors related to Online Help.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0862","description":"Unspecified vulnerability in the Retail - Oracle Retail Markdown Optimization component in Oracle Industry Product Suite 13.1 allows remote attackers to affect integrity via unknown vectors related to Online Help.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0861","description":"Unspecified vulnerability in the Oracle HRMS (Self Service) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0859","description":"Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 ATG RUP6 allows remote attackers to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0858","description":"Unspecified vulnerability in the E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0857","description":"Unspecified vulnerability in the Oracle Workflow Cartridge component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0856","description":"Unspecified vulnerability in the Portal component in Oracle Fusion Middleware 10.1.2.3 and 10.1.4.2 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0855","description":"Unspecified vulnerability in the Portal component in Oracle Fusion Middleware 10.1.2.3 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-0086.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0086","description":"Unspecified vulnerability in the Portal component in Oracle Fusion Middleware 10.1.2.3 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-0855.","exploit_maturity":"No public exploit","published":"2010-04-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-1244","description":"Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.","exploit_maturity":"No public exploit","published":"2010-04-05","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-0684","description":"Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.","exploit_maturity":"No public exploit","published":"2010-04-05","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Low"}, {"cve_id":"CVE-2010-0850","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0849","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface, which allows code execution via a crafted JPEG image.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0848","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"}, {"cve_id":"CVE-2010-0846","description":"Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows remote attackers to execute arbitrary code, related to an \"invalid assignment\" and inconsistent length values in a JPEG image encoder (JPEGImageEncoderImpl).","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0845","description":"Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0844","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is for improper parsing of a crafted MIDI stream when creating a MixerSequencer object, which causes a pointer to be corrupted and allows a NULL byte to be written to arbitrary memory.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0843","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries, which allows remote attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0842","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-0841","description":"Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the Java Runtime Environment that allows remote attackers to execute arbitrary code via a JPEG image that contains subsample dimensions with large values, related to JPEGImageReader and \"stepX\".","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0840","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) \"a similar trust issue with interfaces,\" aka \"Trusted Methods Chaining Remote Code Execution Vulnerability.\"","exploit_maturity":"Exploited in the wild","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Critical"}, {"cve_id":"CVE-2010-0839","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0838","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-0837","description":"Unspecified vulnerability in the Pack200 component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"}, {"cve_id":"CVE-2010-0770","description":"IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service (ORB ListenerThread hang) by aborting an SSL handshake.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0769","description":"IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 does not properly define wsadmin scripting J2CConnectionFactory objects, which allows local users to discover a KeyRingPassword password by reading a cleartext field in the resources.xml file.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"Low"}, {"cve_id":"CVE-2010-0768","description":"Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote attackers to inject arbitrary web script or HTML via the URI.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0095","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0093.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0094","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-0093","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0095.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-0092","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2010-0091","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0084.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0090","description":"Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18 allows remote attackers to affect integrity and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0089","description":"Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0088","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0085.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0087","description":"Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-0085","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0088.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0084","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0091.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-0082","description":"Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"}, {"cve_id":"CVE-2010-1182","description":"Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors.","exploit_maturity":"No public exploit","published":"2010-03-29","resolved":"NO-FIX-IDENTIFIED","severity":"High"}, {"cve_id":"CVE-2010-0563","description":"The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted.","exploit_maturity":"No public exploit","published":"2010-02-08","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2009-2902","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","exploit_maturity":"No public exploit","published":"2010-01-28","resolved":"MITIGATED-BY-RASP","severity":"Medium"}, {"cve_id":"CVE-2009-2901","description":"The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.","exploit_maturity":"No public exploit","published":"2010-01-28","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}, {"cve_id":"CVE-2009-2693","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.","exploit_maturity":"No public exploit","published":"2010-01-28","resolved":"MITIGATED-BY-RASP","severity":"Medium"}, {"cve_id":"CVE-2010-0386","description":"The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.","exploit_maturity":"No public exploit","published":"2010-01-25","resolved":"MITIGATED-BY-RASP","severity":"High"}, {"cve_id":"CVE-2010-0080","description":"Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 Bundle, #21 and 9.0 Bundle #11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0079","description":"Multiple vulnerabilities in the JRockit component in BEA Product Suite R27.6.5 using JRE/JDK 1.4.2, 5, and 6 allow remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this CVE identifier overlaps CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, and CVE-2009-3877.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"}, {"cve_id":"CVE-2010-0078","description":"Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0077","description":"Unspecified vulnerability in the CRM Technical Foundation (mobile) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0075","description":"Unspecified vulnerability in the Oracle HRMS (Self Service) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0074","description":"Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows remote attackers to affect availability via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0070","description":"Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0069","description":"Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0, SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP1, and 10.3.0 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0068","description":"Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP2, and 10.0 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0067","description":"Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2010-0066","description":"Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"}, {"cve_id":"CVE-2009-4611","description":"Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"}, {"cve_id":"CVE-2009-3416","description":"Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote attackers to affect integrity via unknown vectors.","exploit_maturity":"No public exploit","published":"2010-01-13","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"} ]