TeamSHATTER Security Advisory: Database Vault Account Management Vulnerabilites

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory October 20, 2011 Risk Level: Medium Affected versions: Oracle Database Server version 10gR2, 11gR1 and 11gR2 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martinez Fayo of...

CVE-2011-3511

Unspecified vulnerability in the Database Vault component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote authenticated users to affect integrity and availability via unknown vectors related to Privileged Account...

CVE-2011-2322

Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.1.0.7 allows remote authenticated users to affect integrity and availability, related to SYSDBA...

Design/Logic Flaw

Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.1.0.7 allows remote authenticated users to affect integrity and availability, related to SYSDBA...

Design/Logic Flaw

Unspecified vulnerability in the Database Vault component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote authenticated users to affect integrity and availability via unknown vectors related to Privileged Account...

CVE-2011-3511

Oracle Database Vault (Database Vault component) on 10gR2/11gR1/11gR2 is affected by CVE-2011-3511, where users with DV_ACCTMGR or SYSDBA can bypass protections and execute OCIPasswordChange to change any user’s password. Root cause relates to privileged account handling; advisory TeamSHATTER not...

CVE-2011-2322

CVE-2011-2322 affects Oracle Database Server 11.1.0.7 (Database Vault component). The issue, tied to SYSDBA privileges, allows a remote authenticated user to bypass protections and modify user passwords via the OCIPasswordChange API, impacting integrity and availability. The related advisory note...

CVE-2011-2322

Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.1.0.7 allows remote authenticated users to affect integrity and availability, related to SYSDBA...

CVE-2011-3511

Unspecified vulnerability in the Database Vault component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote authenticated users to affect integrity and availability via unknown vectors related to Privileged Account...

CVE-2011-2322: Undefined Security Weakness

Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.1.0.7 allows remote authenticated users to affect integrity and availability, related to SYSDBA...

CVE-2011-3511: Undefined Security Weakness

Unspecified vulnerability in the Database Vault component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote authenticated users to affect integrity and availability via unknown vectors related to Privileged Account...

Symantec Enterprise Vault Detection

Symantec Enterprise Vault, an archiving application, is installed on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid56412; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/06"; scriptnameenglish:"Symantec...

Symantec Enterprise Vault / Oracle Outside In Multiple Vulnerabilities (SYM11-011)

The version of Symantec Enterprise Vault installed on the remote host uses a version of the Oracle Outside In libraries that contain multiple memory corruption vulnerabilities. A remote attacker could exploit these by sending an email with a malicious attachment, which could result in arbitrary...

Cross site scripting

Cross-site scripting XSS vulnerability in Cyber-Ark Password Vault Web Access PVWA 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0459

Cross-site scripting XSS vulnerability in Cyber-Ark Password Vault Web Access PVWA 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0459

CVE-2011-0459 : Cross-site scripting (XSS) in Cyber-Ark Password Vault Web Access (PVWA) affects PVWA v5.0 and earlier, v5.5–v5.5 patch 4, and v6.0–v6.0 patch 2. The vulnerability allows remote attackers to inject arbitrary web script/HTML via unspecified vectors, potentially executing in the bro...

CVE-2011-0459: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cyber-Ark Password Vault Web Access PVWA 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Bitdefender 2011 File Vault - Buffer Overflow Vulnerability

Document Title: =============== Bitdefender 2011 File Vault - Buffer Overflow Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/262.wmv View: http://www.youtube.com/watch?v=98eA1cIAO8k Release Date: ============= 2011-09-01 Vulnerability Laboratory ...

BitDefender IS2011 - FV Buffer Overflow Vulnerability

Document Title: =============== BitDefender IS2011 - FV Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=147 Release Date: ============= 2011-08-29 Vulnerability Laboratory ID VL-ID: ==================================== 147...

BitDefender IS2011 - FV Buffer Overflow Vulnerability

Document Title: =============== BitDefender IS2011 - FV Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=147 Release Date: ============= 2011-08-29 Vulnerability Laboratory ID VL-ID: ==================================== 147...