CVE-2004-1371

Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure...

CVE-2004-1365

Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user...

CVE-2004-0638

The CVE-2004-0638 entry describes a buffer overflow in Oracle’s dbms_system.ksdwrt function (KSDWRTB) that affects Oracle 8i Release 1 8.1.7.4 and Oracle 9i Release 1/2 (9.0.1.4, 9.0.1.5, 9.2.0.3, 9.2.0.4). The vulnerability arises when a long second argument is passed, enabling remote authorized...

CVE-2004-1370

CVE-2004-1370 is a set of confirmed SQL injection vulnerabilities in Oracle 9i/10g that affect PL/SQL procedures running with definer rights. The flaws allow remote attackers to execute arbitrary SQL commands and potentially gain privileges via the following procedures: DBMS_EXPORT_EXTENSION, WK_...

CVE-2004-1338

The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXECCBKFNDML to add arbitrary functions to the SDOCMTDBKFNTABLE and SDOCMTCBKDMLTABLE, then performing a DELETE on the SDOTXNIDXINSERTS table, which...

CVE-2004-2229

Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privileges...

CVE-2004-2244

The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service CPU and memory consumption via a SOAP message containing a...

CVE-2004-1339

SQL injection vulnerability in the 1 MDSYS.SDOGEOMTRIGINS1 and 2 MDSYS.SDOLRSTRIGINS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.tablename or new.columnname parameters...

CVE-2003-1208

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by 1 setting the TIMEZONE session parameter to a long value, or providing long parameters to the 2 NUMTOYMINTERVAL, 3 NUMTODSINTERVAL or 4 FROMTZ functions...

[Full-Disclosure] Buffer Overflow in DBMS_SYSTEM.KSDWRT() in Oracle8i - 9i

http://www.red-database-security.com/advisory/advisory200409033.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in DBMSSYSTEM.KSDWRT in Oracle8i - 9i Systems Affected Oracle 8i - Oracle9i all platforms Severity Medium Risk Category Buffer Overflow/Denial of...

[Full-Disclosure] Buffer Overflow in SYS_CONTEXT() in Oracle 9i Rel.2

http://www.red-database-security.com/advisory/advisory200409032.htm RDS200409032 - Red-Database-Security GmbH Research Advisory Name Buffer Overflow in SYSCONTEXT in Oracle 9i Rel.2 Systems Affected Oracle9i Rel. 2 Windows platform only Severity Medium Risk Category Buffer Overflow Vendor URL...

[Full-Disclosure] SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i

http://www.red-database-security.com/advisory/advisory200409031.htm RDS200409031 - Red-Database-Security GmbH Research Advisory Name SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i Systems Affected Oracle 8i / Oracle9i all platforms Severity High Risk Category SQL Injection Vendor URL...

CVE-2004-1370

Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via 1 DBMSEXPORTEXTENSION, 2 WKACL.GETACL, 3 WKACL.STOREACL, 4 WKADM.COMPLETEACLSNAPSHOT, 5...

Oracle 9i - Multiple Vulnerabilities

Oracle 9i - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also...

CVE-2003-0894

Buffer overflow in the 1 oracle and 2 oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument...

CVE-2003-0894

CVE-2003-0894 affects Oracle 9i Database (9.0.x and 9.2.x up to 9.2.0.4). A buffer overflow in the oracle and oracleO command-line programs can allow a local user to execute arbitrary code with the oracle user’s privileges via a long argv[1]. Public exploit scripts were noted by CERT/CC. Oracle r...

CVE-2003-0894

Buffer overflow in the 1 oracle and 2 oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument...

CVE-2003-0727

Multiple buffer overflows in the XML Database XDB functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions...

Oracle 9i XDB HTTP PASS Overflow (win32)

This module exploits a stack buffer overflow in the authorization code of the Oracle 9i HTTP XDB service. David Litchfield, has illustrated multiple vulnerabilities in the Oracle 9i XML Database XDB, during a seminar on "Variations in exploit methods between Linux and Windows" presented at the...

CVE-2002-0965

Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICENAME parameter, which is not properly handled when writing an error message to a log file...