CVE-2006-7158: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Oracle Application Express APEX before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATIONMSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351...

CVE-2006-7138: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wwvflowutilities.genpopuplist in the WWVFLOWUTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the PLOV parameter and calculating a matching MD5 checksum for the PLOVCHECKSUM parameter. NOTE: i...

Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATION_MSG

Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATIONMSG Name Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATIONMSG Systems Affected Oracle APEX/HTMLDB Severity Medium Risk Category Cross Site Scripting XSS/CSS Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak...

Cross-Site-Scripting Vulnerability in Oracle APEX WWV_FLOW_ITEM_HELP

Name Cross-Site-Scripting Vulnerability in Oracle APEX WWVFLOWITEMHELP Systems Affected Oracle APEX/HTMLDB Severity Medium Risk Category Cross Site Scripting XSS/CSS Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Date 18 October 2006 V 1.00 Advisory...