CVE-2002-1637

Oracle 9i Application Server (9iAS) is affected by CVE-2002-1637 due to default credentials configured across multiple components. Over 160 usernames/passwords are present (e.g., SYS, SYSTEM, AQJAVA, OWA, IMAGEUSER, USER1, USER2, PLSQL, DEMO, FINANCE), which can allow privilege escalation for att...

CVE-2002-1632

CVE-2002-1632 is documented in multiple security feeds as an information disclosure flaw in Oracle 9i Application Server (9iAS). The affected component is the 9iAS sample pages, which can leak environment variables and other sensitive information through the pages named info.jsp, printenv, echo, ...

CVE-2002-1630

The CVE-2002-1630 entry affects Oracle 9i Application Server (9iAS). The vulnerability is in the sendmail.jsp sample page, described as allowing remote attackers to send arbitrary emails. Public details in the provided documents confirm the affected component is the sendmail.jsp page, but there i...

CVE-2004-1707

Oracle 8i/9i and IAS 9.0.2.0.1 on Unix are affected by CVE-2004-1707 due to the dbsnmp and nmo programs. They search a default library path and execute libraries with elevated privileges, enabling certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0. No additional ...

CVE-2005-0297

CVE-2005-0297 concerns a SQL injection vulnerability in Oracle Database 9i and 10g that allows remote attackers to execute arbitrary SQL commands and gain privileges. The available documents identify the affected product family (Oracle Database 9i/10g) and the underlying issue (SQL injection) wit...

CVE-2005-0298

CVE-2005-0298 concerns Oracle 8i–10g DIRECTORY objects that expose the location of a specific operating system directory. Read access to such a DIRECTORY object can allow a user to obtain sensitive information about the OS directory path, indicating a potential information-disclosure risk. The pr...

CVE-2004-1365

Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user...

CVE-2004-1371

Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure...

CVE-2004-1364

CVE-2004-1364 is an Oracle extproc directory traversal vulnerability affecting Oracle 9i and 10g. The flaw allows remote attackers to access arbitrary libraries outside the $ORACLE_HOME/bin directory by leveraging the extproc mechanism, potentially executing OS commands with the privileges of the...

CVE-2004-1370

CVE-2004-1370 is a set of confirmed SQL injection vulnerabilities in Oracle 9i/10g that affect PL/SQL procedures running with definer rights. The flaws allow remote attackers to execute arbitrary SQL commands and potentially gain privileges via the following procedures: DBMS_EXPORT_EXTENSION, WK_...

CVE-2004-1371

CVE-2004-1371 describes a stack-based buffer overflow in Oracle 9i/10g that allows remote attackers to execute arbitrary code by sending a long token in the text of a wrapped procedure. The vulnerability affects Oracle’s database/server components and can enable remote code execution with the att...

CVE-2004-0638

The CVE-2004-0638 entry describes a buffer overflow in Oracle’s dbms_system.ksdwrt function (KSDWRTB) that affects Oracle 8i Release 1 8.1.7.4 and Oracle 9i Release 1/2 (9.0.1.4, 9.0.1.5, 9.2.0.3, 9.2.0.4). The vulnerability arises when a long second argument is passed, enabling remote authorized...

CVE-2004-1365

CVE-2004-1365 affects Oracle 9i/10g extproc. The vulnerability allows local users to load a library or execute a function without authentication, enabling arbitrary commands to run as the Oracle user. This is documented in the NVD entry and reflected in related Nessus/NVD references.

CVE-2004-1339

CVE-2004-1339 affects Oracle 9i and 10g via two default triggers (MDSYS.SDO_GEOM_TRIG_INS1 and MDSYS.SDO_LRS_TRIG_INS). The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands through the new.table_name or new.column_name parameters within those trigger...

CVE-2004-1338

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXECCBKFNDML to add arbitrary functions to the SDOCMTDBKFNTABLE and SDOCMTCBKDMLTABLE, then performing a DELETE on the SDOTXNIDXINSERTS table, which...

CVE-2004-1338

CVE-2004-1338 affects Oracle 9i and 10g. The flaw lets local users escalate privileges by abusing CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to seed arbitrary functions into SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then deleting from SDO_TXN_IDX_INSERTS to trigger SDO_CMT_CBK_TRIG, which executes ...

CVE-2004-2244

The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service CPU and memory consumption via a SOAP message containing a...

CVE-2004-2229

Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privileges...

CVE-2004-1339

SQL injection vulnerability in the 1 MDSYS.SDOGEOMTRIGINS1 and 2 MDSYS.SDOLRSTRIGINS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.tablename or new.columnname parameters...

CVE-2003-1208

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by 1 setting the TIMEZONE session parameter to a long value, or providing long parameters to the 2 NUMTOYMINTERVAL, 3 NUMTODSINTERVAL or 4 FROMTZ functions...