CVE-2018-11040

CVE-2018-11040 affects Spring Framework: 5.0.x before 5.0.7 and 4.3.x before 4.3.18 (and older unsupported versions). The issue arises because JSONP support can be enabled via JSONP parameters when MappingJackson2JsonView is configured, allowing cross-domain requests through AbstractJsonpResponse...

CVE-2008-2603

CVE-2008-2603 is an Oracle Enterprise Manager (Database Control) cross-site scripting vulnerability affecting 10gR1/10gR2/11.1.0.6 where the REFRESHCHOICE parameter can inject arbitrary script/HTML. The issue originates from the July 2008 CPU advisory; vendors released a patch as part of the CPU....

CVE-2009-1966

CVE-2009-1966 affects Oracle Enterprise Manager 10.2.0.4 (and Oracle Database 11.1.0.7) in the Config Management component. The vulnerability is described as an unspecified issue that allows remote, authenticated users to affect confidentiality and integrity via unknown vectors; the Oracle CPU Ju...

CVE-2004-1371

CVE-2004-1371 describes a stack-based buffer overflow in Oracle 9i/10g that allows remote attackers to execute arbitrary code by sending a long token in the text of a wrapped procedure. The vulnerability affects Oracle’s database/server components and can enable remote code execution with the att...

CVE-2004-1363

CVE-2004-1363 : The provided data confirms a buffer overflow in the extproc component of Oracle 10g. An attacker can trigger remote code execution by manipulating environment variables in the library name, which are expanded after the length check. The vulnerability is described as enabling remot...

CVE-2009-1967

CVE-2009-1967 affects Oracle Enterprise Manager (Config Management) on Oracle Database 11.1.0.7 and Oracle Enterprise Manager 10.2.0.4. The vulnerability, described as an unspecified issue, allows a remote attacker with a valid session to affect confidentiality and integrity via an unknown vector...

CVE-2004-1364

CVE-2004-1364 is an Oracle extproc directory traversal vulnerability affecting Oracle 9i and 10g. The flaw allows remote attackers to access arbitrary libraries outside the $ORACLE_HOME/bin directory by leveraging the extproc mechanism, potentially executing OS commands with the privileges of the...

CVE-2004-1367

CVE-2004-1367 affects Oracle 10g Database Server. When installed with a password containing an exclamation point for the DBSNMP or SYSMAN user, an error is logged to the world‑readable postDBCreation.log, potentially exposing the password to local users who could use it against SYS or SYSTEM acco...

CVE-2004-1369

CVE-2004-1369 concerns the TNS Listener in Oracle 10g. The vulnerability allows remote attackers to cause a denial of service (listener crash) by sending a malformed service_register_NSGR request, where a value is used as an invalid offset for a pointer that references incorrect memory. The prima...

CVE-2004-1366

CVE-2004-1366 affects Oracle 10g Database Server, where the password for the SYSMAN account is stored in cleartext in the world-readable emoms.properties file. This local-access weakness could allow unprivileged or local users to gain DBA privileges. No explicit remediation version or patch is pr...

CVE-2004-1365

CVE-2004-1365 affects Oracle 9i/10g extproc. The vulnerability allows local users to load a library or execute a function without authentication, enabling arbitrary commands to run as the Oracle user. This is documented in the NVD entry and reflected in related Nessus/NVD references.

CVE-2004-1368

The CVE-2004-1368 entry affects Oracle ISQL*Plus in Oracle 10g Application Server. The vulnerability allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script, enabling potential arbitrary-file execution on the affected server. The ac...

CVE-2004-1370

CVE-2004-1370 is a set of confirmed SQL injection vulnerabilities in Oracle 9i/10g that affect PL/SQL procedures running with definer rights. The flaws allow remote attackers to execute arbitrary SQL commands and potentially gain privileges via the following procedures: DBMS_EXPORT_EXTENSION, WK_...

CVE-2004-1362

CVE-2004-1362 affects the PL/SQL module of the Oracle HTTP Server in Oracle Application Server 10g when using the WE8ISO8859P1 character set. The issue is a character conversion flaw that allows remote attackers to bypass access restrictions for certain procedures via an encoded URL containing “%...

CVE-2007-5531

Technical details are not publicly available in the provided documents for CVE-2007-5531. The entry only notes an unspecified vulnerability in Oracle Help for Web with unknown impact and remote vectors. No vendor/version/patch details are given. Monitor for updates.

CVE-2013-3791

Oracle Enterprise Manager Grid Control: CVE-2013-3791 corresponds to a cross‑site scripting vulnerability in the Oracle Enterprise Manager Grid Control/EM Base Platform 10.2.0.5 and EM DB Control 11.1.0.7, due to flaws in the UI Framework. Affected products include Enterprise Manager Grid Control...

CVE-2013-3758

Technical details about CVE-2013-3758 are not publicly available in the provided documents; monitor for updates from Oracle and security advisories.

CVE-2019-2895

CVE-2019-2895 affects Oracle Enterprise Manager for Exadata (component: Exadata Plug-In Deploy and Ins). Affects 12.1.0.5.0, 13.2.2.0.0, 13.3.1.0.0, and 13.3.2.0.0. The vulnerability is exploitable remotely over HTTP by a low-privileged attacker and can lead to takeover of Enterprise Manager for ...

CVE-2007-0293

CVE-2007-0293 concerns Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1, with vulnerabilities in the Enterprise Manager Console related to the Oracle Agent EM03, EM04, and EM05. The connected documents indicate that EM05 may be related to CVE-2007-0222. The impact and attack vectors are listed as ...

CVE-2021-2134

CVE-2021-2134 affects Oracle Enterprise Manager for Fusion Middleware (FMW Control Plugin) in version 12.2.1.4. The underlying issue allows a low-privilege, network-accessing attacker over HTTP to cause a hang or frequent crash (DoS). Documented impact is a complete DoS with availability impact; ...

CVE-2024-20916

CVE-2024-20916 affects Oracle Enterprise Manager Base Platform, specifically the Event Management component in version 13.5.0.0. The root cause is insufficient input validation, enabling a highly privileged attacker with access to the physical/adjacent network segment to compromise the Base Platf...

CVE-2021-2008

CVE-2021-2008 affects Oracle Enterprise Manager for Fusion Middleware (FMW Control Plugin) in versions 11.1.1.9 and 12.2.1.3. The vulnerability allows an unauthenticated attacker with network access over HTTP to read, update, insert, or delete data in the EM FMW data set and to partially deny ser...

CVE-2020-2637

The CVE-2020-2637 vulnerability affects Oracle Enterprise Manager for Oracle Database (Change Manager – web based) versions 12.1.0.5, 13.2.0.0, and 13.3.0.0. Affects component: Change Manager web; root cause is not explicitly detailed in the provided documents beyond the described vulnerability. ...

CVE-2020-2638

CVE-2020-2638 affects Oracle Enterprise Manager for Oracle Database (Enterprise Config Management) in 12.1.0.5, 13.2.0.0, and 13.3.0.0. The vulnerability allows a high-privilege attacker with network access over HTTP to gain unauthorized access to data and perform unauthorized updates/deletes, wi...

CVE-2007-0292

CVE-2007-0292/0293 describe multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 (and 10.2.0.1 as referenced) related to the Oracle Agent subcomponents EM01/EM02 for CVE-2007-0292 and EM03/EM04/EM05 for CVE-2007-0293. The descriptions indicate unknown impact and attack vecto...

CVE-2007-0294

Technical details are not publicly available in the provided documents for CVE-2007-0294; the description remains unspecified with unknown impact.

CVE-2006-1885

Technical details about CVE-2006-1885 are not publicly provided in the connected documents. Monitor for updates; current sources list the vulnerability as multiple unspecified issues in Oracle Enterprise Manager Reporting Framework with unknown impact and attack vectors.

CVE-2020-2641

CVE-2020-2641 affects Oracle Enterprise Manager for Oracle Database (component: Discovery Framework) and targets affected versions 12.1.0.5, 13.2.0.0, and 13.3.0.0. The issue is exploitable over the network via HTTP and requires high privileges; successful exploitation can lead to unauthorized ac...

CVE-2007-2129

CVE-2007-2129 describes an unspecified vulnerability in the Agent component of Oracle Enterprise Manager 9.2.0.8 with unknown impact and remote attack vectors (EM01). The available connected data confirms the affected product/component but does not disclose root cause, exploit details, or a remed...

CVE-2020-2640

CVE-2020-2640 affects Oracle Enterprise Manager for Oracle Database (Target Management component). Vulnerable are versions 12.1.0.5, 13.2.0.0 and 13.3.0.0. The vulnerability enables a high-privilege attacker who can reach the service over HTTP to compromise the Enterprise Manager, potentially gai...

CVE-2006-3720

Technical details are not publicly provided in the supplied documents. Monitor for updates on CVE-2006-3720.

CVE-2006-3719

Technical details for CVE-2006-3719 are not publicly provided in the supplied documents. No affected product/version, root cause, impact, or exploit information is available here; monitor for updates.

CVE-2006-3721

Technical details are not publicly available in the provided documents for CVE-2006-3721. No affected products, root cause, or remediation are specified here. Monitor for updates as more information becomes available.