CVE-2002-0560

Oracle 9i Application Server 1.0.2.x with PL/SQL module 3.0.9.8.2 exposes OWA_UTIL procedures (signature, listprint, show_query_columns) to remote attackers, enabling information disclosure. Affected component is the PL/SQL gateway (modplsql) in Oracle 9iAS; exploitation involves unauthenticated ...

CVE-2002-0509

Transparent Network Substrate TNS Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service CPU consumption via a single malformed TCP packet to port 1521...

CVE-2002-0563

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services 1 dms0, 2 dms/DMSDump, 3 servlet/DMSDump, 4 servlet/Spy, 5 soap/servlet/Spy, and 6 dms/AggreSpy; and Oracle Ja...

CVE-2002-0509

CVE-2002-0509 affects Oracle 9i’s Transparent Network Substrate (TNS) Listener (version 9.0.1.1). A remote attacker can cause a denial of service (CPU consumption) by sending a single malformed TCP packet to port 1521. Root cause and exact vulnerable component are stated only as the TNS Listener ...

CVE-2002-0560: Undefined Security Weakness

PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to obtain sensitive information via the OWAUTIL stored procedures 1 OWAUTIL.signature, 2 OWAUTIL.listprint, or 3 OWAUTIL.showquerycolumns...

CVE-2002-0566: Undefined Security Weakness

PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service crash via an HTTP Authorization header without an authentication type...

CVE-2002-0559: Undefined Security Weakness

Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via 1 a long help page request without a dadname, which overflows the resulting HTTP Location header, 2 a long HTTP request to the plsq...

CVE-2002-0561: Undefined Security Weakness

The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings...

CVE-2002-0568: Undefined Security Weakness

Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting 1 XSQLConfig.xml or 2 soapConfig.xml through a virtual directory...

CVE-2002-0564: Undefined Security Weakness

PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor DAD by modifying the URL to reference an alternate DAD that already has valid credentials...

CVE-2002-0509: Undefined Security Weakness

Transparent Network Substrate TNS Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service CPU consumption via a single malformed TCP packet to port 1521...

CVE-2002-0563: Improper Authentication

The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services 1 dms0, 2 dms/DMSDump, 3 servlet/DMSDump, 4 servlet/Spy, 5 soap/servlet/Spy, and 6 dms/AggreSpy; and Oracle Ja...

CVE-2002-0562: Undefined Security Weakness

The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa...

CVE-2002-1641

Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server 9iAS allow remote attackers to execute arbitrary code via unknown vectors...

ansi outer join syntax in Oracle allows access to any data

Hi all I thought this list may be interested in this issue, apologies if its known here already. Oracle 9i includes the new ANSI outer join syntax. Oracle still supports the old syntax but in the new syntax there is a serious security issue that allows any user to view any data. here is an exampl...

CVE-2001-1216

Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page...

CVE-2001-1216

CVE-2001-1216 affects Oracle 9i Application Server’s PL/SQL Apache module (mod_plsql). A buffer overflow in the mod_plsql/PLSQL path can be triggered by a long request for a help page, allowing remote attackers to execute arbitrary code or cause a crash. The vulnerability is tied to Oracle 9iAS’s...

CVE-2001-1217

CVE-2001-1217 describes a directory traversal vulnerability in the PL/SQL Apache module (mod_plsql/mod_plsql) of Oracle 9i Application Server. The issue allows remote attackers to read sensitive files outside the web server’s root by crafting a request with double URL encoded sequences (..). Affe...

CVE-2001-1217

Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. dot dot sequences...

CVE-2001-1217: Undefined Security Weakness

Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. dot dot sequences...