{"api_version":"1","generated_at":"2026-07-23T23:57:12+00:00","cve":"CVE-2016-0491","urls":{"html":"https://cve.report/CVE-2016-0491","api":"https://cve.report/api/cve/CVE-2016-0491.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-0491","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-0491"},"summary":{"title":"CVE-2016-0491","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.","state":"PUBLISHED","assigner":"oracle","published_at":"2016-01-21 03:00:39","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-noinfo","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/81169","name":"http://www.securityfocus.com/bid/81169","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle Enterprise Manager CVE-2016-0491 Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-047","name":"http://www.zerodayinitiative.com/advisories/ZDI-16-047","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/39852/","name":"https://www.exploit-db.com/exploits/39852/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Oracle Application Testing Suite (ATS) - Arbitrary File Upload (Metasploit) - Java remote Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html","name":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Oracle ATS Arbitrary File Upload ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","name":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - January 2016","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1034734","name":"http://www.securitytracker.com/id/1034734","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Oracle Enterprise Manager Grid Control Multiple Flaws Let Remote and Local Users Access Data, Modify Data, and Deny Service - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload","name":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Exim4 string_format Function Heap Buffer Overflow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/39691/","name":"https://www.exploit-db.com/exploits/39691/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Oracle Application Testing Suite (ATS) 12.4.0.2.0 - Authentication Bypass / Arbitrary File Upload - JSP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0491","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0491","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"491","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_testing_suite","cpe6":"12.4.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"491","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"application_testing_suite","cpe6":"12.5.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T22:22:54.834Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"81169","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/81169"},{"name":"39852","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/39852/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"},{"name":"39691","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/39691/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-047"},{"name":"1034734","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1034734"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-01-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-05T14:57:01.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"name":"81169","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/81169"},{"name":"39852","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/39852/"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"},{"name":"39691","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/39691/"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html"},{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-047"},{"name":"1034734","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1034734"},{"tags":["x_refsource_MISC"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2016-0491","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"81169","refsource":"BID","url":"http://www.securityfocus.com/bid/81169"},{"name":"39852","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/39852/"},{"name":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"},{"name":"39691","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/39691/"},{"name":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html"},{"name":"http://www.zerodayinitiative.com/advisories/ZDI-16-047","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-16-047"},{"name":"1034734","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1034734"},{"name":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload","refsource":"MISC","url":"http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2016-0491","datePublished":"2016-01-21T02:00:00.000Z","dateReserved":"2015-12-09T00:00:00.000Z","dateUpdated":"2024-08-05T22:22:54.834Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-01-21 03:00:39","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-noinfo","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_testing_suite:12.4.0.2:*:*:*:*:*:*:*","matchCriteriaId":"08F3E8E4-BD91-4220-B710-960A45C232D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:*","matchCriteriaId":"62E818A9-663D-4AFB-B3D6-686CE4DB9676"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"491","Ordinal":"1","Title":"CVE-2016-0491","CVE":"CVE-2016-0491","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"491","Ordinal":"1","NoteData":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.","Type":"Description","Title":"CVE-2016-0491"},{"CveYear":"2016","CveId":"491","Ordinal":"2","NoteData":"2016-01-20","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"491","Ordinal":"3","NoteData":"2016-12-05","Type":"Other","Title":"Modified"}]}}}