CVE-2004-1362

N/A

Published: January 19, 2005 at 05:00 AM UTC

Updated: June 16, 2026 at 10:07 PM UTC

9 products affected across 1 vendorE Business SuiteApplication ServerEnterprise Manager Grid Control

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 9%

Description

The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Application Server · Oracle

95%

9.0.2 9.0.2.0.0 9.0.2.0.1 9.0.2.1 9.0.2.2 9.0.2.3 9.0.3 9.0.3.1 9.0.4 9.0.4.0 9.0.4.1

Collaboration Suite · Oracle

95%

release_1

E Business Suite · Oracle

95%

11.5.1 11.5.2 11.5.3 11.5.4 11.5.5 11.5.6 11.5.7 11.5.8 11.5.9

Enterprise Manager · Oracle

95%

9 9.0.1

Enterprise Manager Database Control · Oracle

95%

10.1.2

Enterprise Manager Grid Control · Oracle

95%

10.1.0.2

ORACLE10G · Oracle

95%

enterprise_10.1.0.2 enterprise_9.0.4_.0 personal_10.1_.0.2 personal_9.0.4_.0 standard_10.1_.0.2 standard_9.0.4_.0

ORACLE8I · Oracle

95%

enterprise_8.0.5_.0.0enterprise_8.0.6_.0.0enterprise_8.0.6_.0.1enterprise_8.1.5_.0.0enterprise_8.1.5_.0.2enterprise_8.1.5_.1.0enterprise_8.1.6_.0.0enterprise_8.1.6_.1.0enterprise_8.1.7_.0.0enterprise_8.1.7_.1.0enterprise_8.1.7_.4 standard_8.0.6 standard_8.0.6_.3 standard_8.1.5 standard_8.1.6 standard_8.1.7 standard_8.1.7_.0.0 standard_8.1.7_.1 standard_8.1.7_.4