Oracle Enterprise Manager Agent buffer overflow

Added: 11/30/2005 CVE: CVE-2005-3460 BID: 15146 OSVDB: 20664 Background Oracle Application Server 10g includes the emagent.exe program which listens for connections on port 1830/TCP by default. Problem A buffer overflow vulnerability in emagent.exe could allow a remote attacker to execute arbitra...

CVE-2005-3439

Multiple unspecified vulnerabilities in Oracle Database Server 10g up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln 1 DB02, 2 DB03, and 3 DB05 in Change Data Capture; 4 DB07 in Data Pump Export; and 5 DB18, 6 DB19, 7 DB20, 8 DB21, 9 DB22, 10 DB23, 11 DB24, and 12 DB25 in t...

CVE-2005-3454

Technical details are not publicly available in the provided documents for CVE-2005-3454. No specifics on affected products, impact, or remediation are supplied. Monitor for updates.

CVE-2005-3439

Technical details about CVE-2005-3439 are not publicly available in the provided connected documents. Monitor for updates from official advisories and vendor notices.

CVE-2005-3447

Technical details for CVE-2005-3447 are not publicly available in the provided documents; the entry remains with unspecified impact and vectors. Monitor for updates.

Multiple Oracle 10g client vulnerabilities

Vulnerable versions of third party utilities are installed to system path location...

CVE-2005-1495

Oracle Database 9i and 10g disables Fine Grained Audit FGA after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection...

CVE-2005-1496

Oracle 10g DBMS_Scheduler Privilege Escalation (CVE-2005-1496): A flaw in the DBMS_Scheduler package allows a user with CREATE JOB privileges to switch SESSION_USER to SYS, enabling privilege escalation. Affected: Oracle 10g DBMS_Scheduler component. Root cause: vulnerability in how DBMS_Schedule...

CVE-2005-1496

The DBMSScheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSIONUSER to the SYS user...

CVE-2005-1495

CVE-2005-1495 affects Oracle Database 9i/10g where Fine Grained Auditing (FGA) is disabled after the SYS user executes a SELECT on an FGA object, making detection harder and enabling potential evasion of auditing. The available documents describe the vulnerability and its impact but do not provid...

CVE-2005-1496

The DBMSScheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSIONUSER to the SYS user...

Oracle 10g DBMS_SCHEDULER Privilege Escalation

The remote host is running a version of Oracle 10g that, according to its version number, permits a user with CREATE job privileges to switch the sessionuser to SYS, which could allow privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Oracle 9i10g - Database Fine Grained Audit Logging Failure

Oracle 9i10g - Database Fine Grained Audit Logging Failure source: https://www.securityfocus.com/bid/13510/info Oracle 9i/10g Database is prone to a logging failure vulnerability that exists in Fine Grained Audit FGA functionality. Reports indicate that FGA may be disabled inadvertently, without...

Oracle 10g Exploit dbms_scheduler SESSION_USER issue

Name DBMSSCHEDULER SESSIONUSER issue in Oracle 10g Systems Affected Oracle 10g Severity Medium Risk Category Switch Oracle Username to user SYS Vendor URL http://www.oracle.com/ Credit Oracle Metalink Forum 633336.995 Exploit...

Oracle Fine Grained Auditing Issue in Oracle 9i / 10g

Name Oracle Fine Grained Auditing Issue Systems Affected Oracle Database 9i / 10g Severity Medium Risk Category Auditing disabled Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 02 May 2005 V 1.00 Details Fine grained audit FGA does not work if the...

CVE-2005-1197

SQL injection vulnerability in the SYS.DBMSCDCIPUBLISH.CREATESCNCHANGESET procedure in Oracle Database Server 10g allows remote attackers to execute arbitrary SQL commands via the CHANGESETNAME parameter...

CVE-2005-1178

SQL injection vulnerability in Oracle Forms 10g allows remote attackers to execute arbitrary SQL commands via the Query/Where feature...

CVE-2005-1197

CVE-2005-1197 is a SQL injection vulnerability in Oracle Database Server 10g affecting the SYS.DBMS_CDC_IPUBLISH.CREATE_SCN_CHANGE_SET procedure via the CHANGE_SET_NAME parameter. Remote attackers could potentially execute arbitrary SQL commands; impact and remediation details are not specified i...

CVE-2005-1178

The CVE-2005-1178 entry describes an SQL injection vulnerability in Oracle Forms 10g. The vulnerability allows remote attackers to execute arbitrary SQL commands via the Query/Where feature, indicating an injectable input path in the application’s query-building mechanism. According to the NVD en...

CVE-2004-1774

Buffer overflow in the SDOCODESIZE procedure of the MD2 package MDSYS.MD2.SDOCODESIZE in Oracle 10g before 10.1.0.2 Patch 2 allows local users to execute arbitrary code via a long LAYER parameter...