Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.8.0 allows remote attackers to affect confidentiality via unknown vectors related to Portlet Services.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1622 to the following vulnerability:

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1622 [2] http://www.securityfocus.com/archive/1/511877 [3] http://www.exploit-db.com/exploits/13918 [4] http://www.springsource.com/security/cve-2010-1622 [5] http://www.securityfocus.com/bid/40954

Credit: The issue was discovered by Meder Kydyraliev, Google Security Team