CVE

Id
13299  
CVE No.
CVE-2005-2093  
Status
Candidate  
Description
Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."  
Phase
Assigned (20050630)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
96022 13299 CVE-2005-2093 BUGTRAQ:20050606 A new whitepaper by Watchfire - HTTP Request Smuggling  View
96023 13299 CVE-2005-2093 URL:http://seclists.org/lists/bugtraq/2005/Jun/0025.html  View
96024 13299 CVE-2005-2093 MISC:http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf  View
96025 13299 CVE-2005-2093 MISC:http://www.securiteam.com/securityreviews/5GP0220G0U.html  View
96026 13299 CVE-2005-2093 XF:oracle-applicationserver-hrs(42902)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
62236 JVNDB-2005-000438 SquirrelMail の $_POST 変数処理におけるクロスサイトスクリプティングの脆弱性 SquirrelMail には、options_identities.php において、$_POST 変数を extract() 関数により不適切にインポートしているため、重要な変数が上書きされてしまう脆弱性が存在します。 CVE-2005-2095 13299 4.3 http://jvndb.jvn.jp/ja/contents/2005/JVNDB-2005-000438.html  View