This page lists publicly disclosed CVE vulnerabilities affecting orionserver orion_application_server (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2006-0816 | Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot) and (2) space characters in the extension of a URL. | [email protected] | 5.0 | 1.26% | 2006-03-24 | 2026-04-16 |
| CVE-2005-2981 | Cross-site scripting (XSS) vulnerability in Orion 1.3.8 and 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page. | [email protected] | 4.3 | 0.32% | 2005-09-20 | 2026-04-16 |
| CVE-2002-1859 | Orion Application Server 1.5.3, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF."). | [email protected] | 5.0 | 0.35% | 2002-12-31 | 2026-04-16 |