CVE-2011-3525

Unspecified vulnerability in the Application Express component in Oracle Database Server 3.2 and 4.0 allows remote authenticated users to affect confidentiality, integrity, and availability, related to APEX developer user...

Oracle存在多个安全漏洞

CNCAN ID：CNCAN-2009041604 多个Oracle产品存在漏洞，可导致SQL注入，泄漏敏感信息或使攻击者破坏系统： -Oracle Process Manager和Notification opmn守护程序存在格式串错误，提交特殊构建的POST请求给port 6000/TCP可导致任意代码执行。 -传递给"DBMSAQIN"的输入在使用前缺少过滤，可导致注入任意SQL代码。 -Oracle数据库包含的Application Express组件存在错误，非特权用户可以获得"LOWS030000.WWVFLOWUSER"中的APEX密码HASH。 目前还存在多个未知漏洞。...

Oracle APEX 3.2 Unprivileged DB users can see APEX password hashes

No description provided by source. Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Name Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Systems Affected APEX 3.0 optional component of 11.1.0.7 installation...

Unprivileged DB users can see APEX password hashes

Name Unprivileged DB users can see APEX password hashes Systems Affected APEX 3.0 optional component of 11.1.0.7 installation Severity High Risk Category Password Disclosure Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com CVE CVE-2009-0981 Advisory 14...

Oracle APEX 3.2 Unprivileged DB users can see APEX password hashes

Exploit for multiple platform in category local exploits ================================================================== Oracle APEX 3.2 Unprivileged DB users can see APEX password hashes ================================================================== Unprivileged DB users can see APEX...

APEX Password Hash Disclosure

Name Unprivileged DB users can see APEX password hashes Systems Affected APEX 3.0 optional component of 11.1.0.7 installation Severity High Risk Category Password Disclosure Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com CVE CVE-2009-0981 Advisory 14...

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Name Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Systems Affected APEX 3.0 optional...

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes

Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Name Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Systems Affected APEX 3.0 optional component of 11.1.0.7 installation Severity High Risk Category Password...

CVE-2009-0981

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that...

Design/Logic Flaw

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that...

CVE-2009-0981

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that...

CVE-2009-0981

CVE-2009-0981 concerns Oracle Database 11.1.0.7 with the Application Express (APEX) component. The connected Nessus/NASIL-derived data confirms a data-exposure issue where unprivileged/remote-authenticated database users can access APEX password hashes stored in FLOWS_030000.WWV_FLOW_USER (and re...

Advisory for Oracle CPU October 2008 - APEX Flows excessive privileges

Advisory for Oracle CPU October 2008 - APEX FLOWS excessive privileges ====================================================================== See http://www.petefinnigan.com/AdvisoryCPUOct2008.htm for details Description ----------- Oracle Appication Express APEX is a rapid development tool for...

CVE-2008-1822

Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02...

Oracle Security: SQL Injection in APEX CHECK_DB_PASSWORD

SQL Injection Vulnerability in Oracle APEX CHECKDBPASSWORD This advisory http://www.red-database-security.com/advisory/oracleapexsqlinjectioncheckdbpassword.html Name SQL Injection Vulnerability in Oracle CHECKDBPASSWORD Systems Oracle APEX Severity Medium Risk Category SQL Injection Author...

CVE-2006-7138

SQL injection vulnerability in wwvflowutilities.genpopuplist in the WWVFLOWUTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the PLOV parameter and calculating a matching MD5 checksum for the PLOVCHECKSUM parameter. NOTE: i...

CVE-2006-7158

Cross-site scripting XSS vulnerability in Oracle Application Express APEX before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATIONMSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351...

CVE-2006-7138

CVE-2006-7138 affects Oracle Application Express/HTMLDB (APEX) prior to 2.2. The issue is an SQL injection in WWV_FLOW_UTILITIES.gen_popup_list inside the WWV_FLOW_UTILITIES package, enabling remote authenticated users to alter P_LOV and calculate a matching MD5 checksum for P_LOV_CHECKSUM to exe...

CVE-2006-7158

Cross-site scripting XSS vulnerability in Oracle Application Express APEX before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATIONMSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351...

CVE-2006-7138

SQL injection vulnerability in wwvflowutilities.genpopuplist in the WWVFLOWUTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the PLOV parameter and calculating a matching MD5 checksum for the PLOVCHECKSUM parameter. NOTE: i...