Trending
CVE-2002-0563

CVE detail

CVE-2002-0563

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.

CVSS 5.0 · MediumBuzz score 12.03 OTX pulses

Buzz score

Why this CVE is surfacing

Buzz score total 12.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 0.0 · diversity 0.0 · KEV 0.0 · OTX 12.0 · PoC 0.0

Mention score

0.0

0 evidence mentions in the snapshot

Diversity score

0.0

0 sources across 0 categories

KEV score

0.0

No KEV entry observed

OTX score

12.0

3 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

0 source links · newest first

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2002-0559
Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long he…
CVSS 7.5 · High
CVE-2002-0560
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWA_UTIL stored procedures (1) OWA_UTIL.signature,…
CVSS 5.0 · Medium
CVE-2002-0561
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gai…
CVSS 7.5 · High
CVE-2002-0564
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to ref…
CVSS 7.5 · High
CVE-2002-0566
PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an authentica…
CVSS 5.0 · Medium
CVE-2006-0552
Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identif…
CVSS 7.5 · High

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2002-0563.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:oracle:application_serverSearch this product on Shodan
cpe:2.3:a:oracle:application_server_web_cacheSearch this product on Shodan
cpe:2.3:a:oracle:oracle8iSearch this product on Shodan
cpe:2.3:a:oracle:oracle9iSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2002-0563Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Unavailable

Published

Jul 3, 2002

Modified

Jun 16, 2026

Official record

Authoritative NVD record

CVSS vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE IDs

Vendor classifications

How this vector reads

CVSS 2.0 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Access Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Access Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Authentication (Au): None. The attacker does not need to authenticate.
Confidentiality Impact (C): Partial. There is a limited impact to this security property.
Integrity Impact (I): None. There is no impact to this security property.
Availability Impact (A): None. There is no impact to this security property.

Signals

Exploitation indicators

3 stored signals · no KEV · 3 OTX pulses

OTXOTX
- author_name: Q.Vashti
- created: 2026-03-22T03:41:32.565000+00:00
- description:
- name: Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos
- pulse_id: 69bf64eccb5d39a90a3c391e
- tags:
- url: https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e
Observed Mar 22, 2026, 3:41 AM
OTXOTX
- author_name: Q.Vashti
- created: 2026-03-22T03:41:21.863000+00:00
- description:
- name: Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos
- pulse_id: 69bf64e1d5e06aa6207f78de
- tags:
- url: https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de
Observed Mar 22, 2026, 3:41 AM
OTXOTX
- author_name: msudosos
- created: 2026-02-13T03:00:49.872000+00:00
- description: Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (“Broken Seal”) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.
- name: “Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)
- pulse_id: 698e93e1ab02db8c49e8c3ed
- tags:
- url: https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed
Observed Feb 13, 2026, 3:00 AM