Description
Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.
Remediation
References
Related Vulnerabilities
WordPress Plugin IMDb Profile Widget Local File Inclusion (1.0.8)
MySQL CVE-2022-21484 Vulnerability (CVE-2022-21484)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5479)
Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2019-16943)
WordPress Plugin JSON Content Importer Cross-Site Scripting (1.3.15)