CVE-2007-5897

Buffer overflow in Oracle Database Server (MDSYS.SDO_CS) allows remote authenticated users to crash the server and execute arbitrary code via the TRANSFORM function. Affected: Oracle 8iR3, 9iR1/2 up to 9.2.0.6, and 10gR1 up to 10.1.0.4. Note: this CVE may be related to CVE-2007-5515, CVE-2007-550...

CVE-2005-0701

Oracle Database Server 8i/9i is affected by a directory traversal vulnerability in the UTL_FILE package (FOPEN, FRENAME) that allows remote attackers to read or rename arbitrary files via crafted ... sequences. The issue stems from insufficient input validation on file-path arguments to UTL_FILE...

CVE-2006-2081

CVE-2006-2081 affects Oracle Database Server 10g Release 2, where local users can trigger arbitrary SQL via the GET_DOMAIN_INDEX_METADATA function in DBMS_EXPORT_EXTENSION. The primary issue is insecure privileges that allow SQL to be introduced outside of a character-based injection, not a tradi...

CVE-2003-0727

CVE-2003-0727 refers to multiple buffer overflows in the Oracle 9i Database Release 2 XML DB (XDB) functionality. Public references describe stack/buffer overflow conditions in Oracle 9i XDB services (HTTP and FTP) that can be triggered by long inputs to XDB commands, enabling local users to caus...

CVE-2009-1996

CVE-2009-1996 affects Oracle Database Logical Standby (Oracle Net) and is listed among Oracle’s January 2010 CPU fixes. The vulnerability allows a remote attacker (no authentication required for the exploit in some vectors) to impact integrity via unknown vectors; the CVSSv2 base score in NVD is ...

CVE-2006-7141

CVE-2006-7141 is an Oracle Database Server directory traversal vulnerability in the UTL_FILE package. When utl_file_dir is wildcarded or CREATE ANY DIRECTORY to PUBLIC privileges exist, remote authenticated users may read or modify arbitrary files via full file paths to utl_file functions such as...

CVE-2005-0297

CVE-2005-0297 concerns a SQL injection vulnerability in Oracle Database 9i and 10g that allows remote attackers to execute arbitrary SQL commands and gain privileges. The available documents identify the affected product family (Oracle Database 9i/10g) and the underlying issue (SQL injection) wit...

CVE-2007-5511

CVE-2007-5511 is a SQL injection vulnerability in Oracle Database Workspace Manager (SYS.LT.FINDRICSET) that allows an attacker to execute arbitrary SQL via the vulnerable parameter. The flaw affects Workspace Manager components prior to OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0. Public w...

CVE-2007-5510

CVE-2007-5511 relates to an SQL injection vulnerability in Oracle Database's SYS.LT.FINDRICSET function (Workspace/ LT package), exploitable via an Evil Cursor technique to escalate privileges to SYS. Reported for Oracle Database around 10g (pre-10.2.0.x), with exploitation potentially performed ...

CVE-2007-5554

CVE-2007-5554 involves Oracle database servers where remote attackers can obtain server memory contents via crafted packets (Oracle reference number 7892711). The connected documents do not specify affected versions or concrete exploitation details. No remediation or mitigations are provided in t...

CVE-2007-6260

CVE-2007-6260 affects Oracle 10g and llg installations where accounts are created with default passwords, enabling remote login by connecting to the Listener. The underlying cause is default credentials during setup. In practice, DBCA installations may mitigate this by disabling accounts or chang...