CVE-2001-0836: oracle application_server_web_cache

EPSS trend

Probability

14.67%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 14.67% on 21-09-2026

21-09-202621-10-2026

EPSS score

14.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremotewindowsVerified
Oracle9iAS Web Cache 2.0 - Remote Buffer Overflow
Maturity: weaponized

References

7 links

exchange.xforce.ibmcloud.com/vulnerabilities/7306VDB EntryX Refsource XF
www.cert.org/advisories/CA-2001-29.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
otn.oracle.com/deploy/security/pdf/webcache.pdfX Refsource CONFIRM
www.osvdb.org/5534VDB EntryX Refsource OSVDB
marc.info?l=bugtraq&m=100395487007578&w=2Mailing ListX Refsource BUGTRAQ
www.kb.cert.org/vuls/id/649979Third Party AdvisoryX Refsource CERT VNUS Government Resource
marc.info?l=bugtraq&m=100342151132277&w=2Mailing ListX Refsource BUGTRAQ

Related vulnerabilities

CVE-2004-0385oracleapplication_server_web_cache+115.50%22y ago16-04-2004 04:00Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities."CVE-2002-1641oracleapplication_server_web_cache9.05%21y ago28-03-2005 05:00Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors.CVE-2002-0103oracleapplication_server_web_cache0.61%24y ago15-03-2002 05:00An installer program for Oracle9iAS Web Cache 2.0.0.x creates executable and configuration files with insecure permissions, which allows local users to gain privileges by (1) running webcached or (2) obtaining the administrator password from webcache.xml.CVE-2002-0565oracleapplication_server+25.65%24y ago11-06-2002 04:00Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.CVE-2002-0564oracleapplication_server+35.05%24y ago11-06-2002 04:00PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.CVE-2002-0566oracleapplication_server+33.57%24y ago11-06-2002 04:00PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an authentication type.

All vulnerabilities inapplication_server_web_cache

CVE-2001-0836: oracle application_server_web_cache

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References