Oracle DBMS绕过登录访问控制漏洞

BUGTRAQ ID: 16287 CVECAN ID: CVE-2006-0256 Oracle Database是一款大型商业数据库系统。 Oracle Database的登录过程实现存在漏洞，远程攻击者可能在登录过程中对服务器进行SQL注入攻击。...

Oracle SYS.DBMS_METADATA_UTIL软件包SQL注入漏洞

Oracle Database是一款商业性质大型数据库系统。 Oracle SYS.DBMSMETADATAUTIL软件包的LONG2VARCHAR、LONG2VCMAX、LONG2VCNT和LONG2CLOB函数中存在4个SQL注入漏洞。成功利用这些漏洞的远程攻击者可以完全入侵受影响的数据库系统。 Oracle 10g Release 1 Oracle ------ Oracle已经为此发布了一个安全公告（cpujan2006）以及相应补丁: cpujan2006：Oracle Critical Patch Update - January 2006...

Oracle 10g R2 and, probably, all previous versions

I can't believe it. Oracle releases new patches and they have not been solved one of the main problems: A user with only the SELECT privilege can do WHATEVER SHE WANTS WITH THE ENTIRE DATABASE!!!! I'm not sure if is time to full disclosure it but, anyway, I will "full disclosure" one inocent issu...

Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21]

Name SQL Injection in package SYS.DBMSSTATS 6980751 DB21 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Advisory...

Oracle Database - SQL Injection in SYS.KUPW$WORKER [DB03]

Name SQL Injection in package SYS.KUPW$WORKER 6980775 DB03 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Advisory...

Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01]

Name SQL Injection in package SYS.DBMSCDCIMPDP 6980711 DB01 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Details The package SYS.DBMSCDCIMPDP contains...

Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01]

Name SQL Injection in package SYS.DBMSCDCIMPDP 6980711 DB01 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Details The package SYS.DBMSCDCIMPDP contains...

Multiple Cisco Security Monitoring, Analysis and Response System security vulnerabilities

Default preconfigured Oracle databse account, JBoss code execution, multiple administrative interface code executions...

CVE-2006-3702

Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, aka Oracle Vuln 1 DB06 in Export; 2 DB08, 3 DB09, 4 DB10, 5 DB11, 6 DB12, 7 DB13, 8 DB14, and 9 DBC01 for OCI; 10 DB16 for Query Rewrite/Summary Mgmt; ...

CVE-2006-3701

Unspecified vulnerability in the Dictionary component in Oracle Database 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln DB05...

CVE-2006-3700

Multiple unspecified vulnerabilities in Oracle Database 9.2.0.6 and 10.1.0.4 have unknown impact and attack vectors, aka Oracle Vuln 1 DB04 for Web Distributed Authoring and Versioning DAV and 2 DB23 for XMLDB...

CVE-2006-3703

CVE-2006-3703 concerns InterMedia for Oracle Database across versions 9.0.1.5, 9.2.0.6, and 10.1.0.4. The description in the NVD entry characterizes this as an unspecified vulnerability with unknown impact and attack vectors, and the connected data confirms InterMedia as the affected component wi...

CVE-2006-3702

CVE-2006-3702 covers multiple Oracle Database vulnerabilities across versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 with unspecified impact/attack vectors. Connected sources tie DB06 to a SQL injection-style issue in DBMS_EXPORT_EXTENSION, specifically GET_DOMAIN_INDEX_METADATA, which...

CVE-2006-3702

Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, aka Oracle Vuln 1 DB06 in Export; 2 DB08, 3 DB09, 4 DB10, 5 DB11, 6 DB12, 7 DB13, 8 DB14, and 9 DBC01 for OCI; 10 DB16 for Query Rewrite/Summary Mgmt; ...

CVE-2006-3700

CVE-2006-3700 affects Oracle Database 9.2.0.6 and 10.1.0.4 with two concerns (DB04 DAV and DB23 XMLDB). The NVD entry notes unknown impact/attack vectors. A Nessus July 2006 CPU plugin associates CVE-2006-3700 with missing CPU and lists impacted components including DAV/XMLDB; remediation guidanc...

CVE-2006-3700

Multiple unspecified vulnerabilities in Oracle Database 9.2.0.6 and 10.1.0.4 have unknown impact and attack vectors, aka Oracle Vuln 1 DB04 for Web Distributed Authoring and Versioning DAV and 2 DB23 for XMLDB...

CVE-2006-3699

CVE-2006-3699 affects Oracle Database Core RDBMS components in versions 9.0.1.5 and 9.2.0.6. The description remains: an unspecified vulnerability with unknown impact/attack vectors (aka Oracle Vuln# DB02). The connected Nessus entry lists this CVE among July 2006 CPU fixes but provides no furthe...

CVE-2006-3705

CVE-2006-3705 concerns Oracle Database 10.1.0.5 with two unnamed vulnerabilities (DB21: Statistics, DB22: Upgrade/Downgrade) that Oracle notes may be SQL injection in SYS.DBMS_STATS and SYS.DBMS_UPGRADE. The connected documents corroborate that these issues are related to SQL injection in SYS pac...

Oracle Database Detection

Binary data oracledetect.nbin...

Oracle DBMS_EXPORT_EXTENSION package vulnerable to SQL injection

Overview A vulnerability in Oracle PL/SQL Export Extensions may allow an attacker to modify privileged database information. Description Oracle Extensions, ODCIIndex Interface, andODCIIndexGetMetadata Oracle extensions are used to create customized Oracle database constructs. An indextype is an...