388 matches found
Design/Logic Flaw
Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02...
CVE-2008-1811
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows030000.wwvexecuteimmediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher...
CVE-2008-1811
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows030000.wwvexecuteimmediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher...
CVE-2008-1822
CVE-2008-1822 describes an unspecified vulnerability in the Oracle Application Express component of Oracle Application Express 3.0.1 (aka APEX02). The connected sources indicate the issue has unknown impact and remote attack vectors, with a NVD CVSS v2 base score of 10.0 (HIGH). There are no prov...
CVE-2008-1822
Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02...
CVE-2008-1811
CVE-2008-1811 relates to Oracle Application Express 3.0.1. The vulnerability lies in the flows_030000.wwv_execute_immediate.run_ddl function within the wwv_execute_immediate package, in the flows_030000 schema, enabling privilege escalation by certain remote authenticated users (non-DBA). The iss...
iDefense Security Advisory 04.15.08: Oracle Application Express Privilege Escalation Vulnerability
iDefense Security Advisory 04.15.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 15, 2008 I. BACKGROUND Oracle Application Express Oracle APEX, formerly called HTML DB, is a rapid web application development tool for the Oracle database. For more information about Oracle Application...
CVE-2008-1811: Undefined Security Weakness
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows030000.wwvexecuteimmediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher...
CVE-2008-1822: Undefined Security Weakness
Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02...
Sql injection
Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...
CVE-2007-3860
Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...
CVE-2007-3860
CVE-2007-3860 affects Oracle Application Express (APEX) versions 2.2.0.00.32 through 3.0.0.00.20. The vulnerability is described as an SQL injection in wwv_flow_security.check_db_password due to insufficient checks for the '"' character. The connected sources indicate this is a SQL injection vuln...
CVE-2007-3860
Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...
CVE-2007-3860: Undefined Security Weakness
Unspecified vulnerability in Oracle Application Express formerly Oracle HTML DB 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwvflowsecurity.checkdbpassword...
CVE-2006-7158
Oracle Application Express (APEX/HTMLDB) prior to version 2.2.1 is affected by a cross-site scripting (XSS) vulnerability in the NOTIFICATION_MSG parameter in the APEX UI. The issue allows remote attackers to inject arbitrary web script or HTML. The root cause is insufficient input handling for t...
CVE-2006-7158: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Oracle Application Express APEX before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATIONMSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351...
CVE-2006-5599
Cross-site scripting XSS vulnerability in Oracle Application Express formerly HTML DB before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWVFLOWITEMHELP package. NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle...
CVE-2006-5599
Technical details about CVE-2006-5599 are not publicly available in the provided connected documents. No specifics on affected components, root cause, affected versions, or remediation are included. Monitor for updates.
CVE-2006-5599
Cross-site scripting XSS vulnerability in Oracle Application Express formerly HTML DB before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWVFLOWITEMHELP package. NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle...
CVE-2006-5599: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Oracle Application Express formerly HTML DB before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWVFLOWITEMHELP package. NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle...