CVE-2012-1751: Undefined Security Weakness

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to flashback archive...

CVE-2012-3146: Undefined Security Weakness

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity via unknown vectors...

PT-2012-3503

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.1.0.7 through 11.2.0.3 Description The issue affects the confidentiality, integrity, and availability of the system. It can be exploited by remote authenticated users via unknown vectors related to flashback...

PT-2012-4514

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.2.0.3 through 10.2.0.5 Oracle Database Server versions 11.1.0.7 Oracle Database Server versions 11.2.0.2 through 11.2.0.3 Description The issue affects the integrity of the system, allowing remote authenticat...

PT-2012-4519

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.2.0.4 through 10.2.0.5 Oracle Database Server versions 11.1.0.7 Oracle Database Server versions 11.2.0.2 through 11.2.0.3 Description The issue affects the integrity and availability of the system, allowing...

CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

CVE-2012-3137

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

CVE-2012-3137: Improper Authentication

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

PT-2012-4505

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.2.0.3 through 10.2.0.5 Oracle Database Server versions 11.1.0.7 Oracle Database Server versions 11.2.0.2 through 11.2.0.3 Description The issue allows remote attackers to obtain the session key and salt for...

Flaw in Oracle Logon Protocol Leads to Easy Password Cracking

There is a serious vulnerability in the authentication protocol used by some Oracle databases, a flaw that could enable a remote attacker to brute-force a token provided by the server prior to authentication and determine a user’s password. The attacker could then log on as an authenticated user...

Sql injection

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMSSTATS.GATHERTABLESTATS...

CVE-2012-3132

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMSSTATS.GATHERTABLESTATS...

CVE-2012-3132: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMSSTATS.GATHERTABLESTATS...

PT-2012-4500

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.2.0.3 through 10.2.0.5 Oracle Database Server versions 11.1.0.7 Oracle Database Server versions 11.2.0.2 through 11.2.0.3 Description The issue allows remote authenticated users to execute arbitrary SQL...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These updated packages fix the following security issues : - a flaw in the hypervisor for hosts running on Itanium architectures allowed an Intel VTi domain to read arbitrary physical memory from other Intel VTi domains, which could make information available to unauthorized users. CVE-2007-6207,...

Oracle Database Multiple Vulnerabilities (July 2012 CPU)

The remote Oracle database server is missing the July 2012 Critical Patch Update CPU and is, therefore, potentially affected by security issues in the following components : - Enterprise Manager - Network Layer - Core RDBMS %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2012-1746

Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, when running on Windows, allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2012-1747...

CVE-2012-1737

Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Enterprise Manager Grid Control EM Base Platform 10.2.0.5, EM Base Platform 11.1.0.1, EM Plugin for DB 12.1.0.1, and EM Plugin for DB 12.1.0.2, allows...

Design/Logic Flaw

Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Enterprise Manager Grid Control EM Base Platform 10.2.0.5, EM Base Platform 11.1.0.1, EM Plugin for DB 12.1.0.1, and EM Plugin for DB 12.1.0.2, allows...

Design/Logic Flaw

Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to affect availability via unknown vectors...