Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes

Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Name Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Systems Affected APEX 3.0 optional component of 11.1.0.7 installation Severity High Risk Category Password...

CVE-2006-7158

Cross-site scripting XSS vulnerability in Oracle Application Express APEX before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATIONMSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351...

CVE-2006-7138

SQL injection vulnerability in wwvflowutilities.genpopuplist in the WWVFLOWUTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the PLOV parameter and calculating a matching MD5 checksum for the PLOVCHECKSUM parameter. NOTE: i...

CVE-2006-7138

CVE-2006-7138 affects Oracle Application Express/HTMLDB (APEX) prior to 2.2. The issue is an SQL injection in WWV_FLOW_UTILITIES.gen_popup_list inside the WWV_FLOW_UTILITIES package, enabling remote authenticated users to alter P_LOV and calculate a matching MD5 checksum for P_LOV_CHECKSUM to exe...

CVE-2006-7138

SQL injection vulnerability in wwvflowutilities.genpopuplist in the WWVFLOWUTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the PLOV parameter and calculating a matching MD5 checksum for the PLOVCHECKSUM parameter. NOTE: i...

Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATION_MSG

Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATIONMSG Name Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATIONMSG Systems Affected Oracle APEX/HTMLDB Severity Medium Risk Category Cross Site Scripting XSS/CSS Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak...