Oracle Database - SQL Injection in SYS.DBMS_UPGRADE [DB22]

Name SQL Injection in package SYS.DBMSUPGRADE 6980717 DB22 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Advisory...

CVE-2006-3705

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln 1 DB21 for Statistics and 2 DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection...

CVE-2006-3705

CVE-2006-3705 concerns Oracle Database 10.1.0.5 with two unnamed vulnerabilities (DB21: Statistics, DB22: Upgrade/Downgrade) that Oracle notes may be SQL injection in SYS.DBMS_STATS and SYS.DBMS_UPGRADE. The connected documents corroborate that these issues are related to SQL injection in SYS pac...