201 matches found
[Full-Disclosure] Buffer Overflow in DBMS_SYSTEM.KSDWRT() in Oracle8i - 9i
http://www.red-database-security.com/advisory/advisory200409033.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in DBMSSYSTEM.KSDWRT in Oracle8i - 9i Systems Affected Oracle 8i - Oracle9i all platforms Severity Medium Risk Category Buffer Overflow/Denial of...
[Full-Disclosure] Buffer Overflow in SYS_CONTEXT() in Oracle 9i Rel.2
http://www.red-database-security.com/advisory/advisory200409032.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in SYSCONTEXT in Oracle 9i Rel.2 Systems Affected Oracle9i Rel. 2 Windows platform only Severity Medium Risk Category Buffer Overflow Vendor URL...
[Full-Disclosure] SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i
http://www.red-database-security.com/advisory/advisory200409031.htm RDS200409031 - Red-Database-Security GmbH Research Advisory Name SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i Systems Affected Oracle 8i / Oracle9i all platforms Severity High Risk Category SQL Injection Vendor URL...
CVE-2004-1370
Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via 1 DBMSEXPORTEXTENSION, 2 WKACL.GETACL, 3 WKACL.STOREACL, 4 WKADM.COMPLETEACLSNAPSHOT, 5...
Oracle 9i - Multiple Vulnerabilities
Oracle 9i - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also...
CVE-2003-0894
Buffer overflow in the 1 oracle and 2 oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument...
CVE-2003-0894
CVE-2003-0894 affects Oracle 9i Database (9.0.x and 9.2.x up to 9.2.0.4). A buffer overflow in the oracle and oracleO command-line programs can allow a local user to execute arbitrary code with the oracle user’s privileges via a long argv[1]. Public exploit scripts were noted by CERT/CC. Oracle r...
CVE-2003-0894
Buffer overflow in the 1 oracle and 2 oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument...
CVE-2003-0727
Multiple buffer overflows in the XML Database XDB functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions...
CVE-2002-0569
Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet XSQLServlet...
CVE-2002-0567
Oracle 8i and 9i with PL/SQL package for External Procedures EXTPROC allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process...
CVE-2002-0965
Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICENAME parameter, which is not properly handled when writing an error message to a log file...
CVE-2002-0569
CVE-2002-0569 affects Oracle 9i Application Server via the XSQLServlet, enabling remote authentication bypass to access configuration files. The core issue is bypassing access restrictions on configuration files through direct requests to XSQLServlet, leading to potential exposure of sensitive fi...
CVE-2001-1372
Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message...
CVE-2001-1372
CVE-2001-1372 affects Oracle 9i Application Server (AS) 1.0.2. It enables an attacker to disclose the server’s physical webroot path by requesting a non-existent .JSP file, because the default error message leaks the pathname. The vulnerability is a information disclosure issue, with CVSS-like co...
CVE-2003-0096
Oracle 9i/8i family affected by CVE-2003-0096 due to multiple buffer overflows in Oracle Database: TO_TIMESTAMP_TZ (long conversion string argument), TZ_OFFSET (long time zone argument), and BFILENAME (long DIRECTORY parameter). Remote code execution could be possible. Root cause: buffer overflow...
CVE-2002-2345
Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access...
CVE-2002-1636
Cross-site scripting XSS vulnerability in the htp PL/SQL package for Oracle 9i Application Server 9iAS allows remote attackers to inject arbitrary web script or HTML via the cbuf parameter to htp.print...
CVE-2002-1632
Oracle 9i Application Server 9iAS installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via 1 info.jsp, 2 printenv, 3 echo, or 4 echo2...