CVE-2004-1371

CVE-2004-1371 describes a stack-based buffer overflow in Oracle 9i/10g that allows remote attackers to execute arbitrary code by sending a long token in the text of a wrapped procedure. The vulnerability affects Oracle’s database/server components and can enable remote code execution with the att...

CVE-2004-1363

CVE-2004-1363 : The provided data confirms a buffer overflow in the extproc component of Oracle 10g. An attacker can trigger remote code execution by manipulating environment variables in the library name, which are expanded after the length check. The vulnerability is described as enabling remot...

CVE-2004-1364

CVE-2004-1364 is an Oracle extproc directory traversal vulnerability affecting Oracle 9i and 10g. The flaw allows remote attackers to access arbitrary libraries outside the $ORACLE_HOME/bin directory by leveraging the extproc mechanism, potentially executing OS commands with the privileges of the...

CVE-2004-1367

CVE-2004-1367 affects Oracle 10g Database Server. When installed with a password containing an exclamation point for the DBSNMP or SYSMAN user, an error is logged to the world‑readable postDBCreation.log, potentially exposing the password to local users who could use it against SYS or SYSTEM acco...

CVE-2004-1369

CVE-2004-1369 concerns the TNS Listener in Oracle 10g. The vulnerability allows remote attackers to cause a denial of service (listener crash) by sending a malformed service_register_NSGR request, where a value is used as an invalid offset for a pointer that references incorrect memory. The prima...

CVE-2004-1366

CVE-2004-1366 affects Oracle 10g Database Server, where the password for the SYSMAN account is stored in cleartext in the world-readable emoms.properties file. This local-access weakness could allow unprivileged or local users to gain DBA privileges. No explicit remediation version or patch is pr...

CVE-2004-1365

CVE-2004-1365 affects Oracle 9i/10g extproc. The vulnerability allows local users to load a library or execute a function without authentication, enabling arbitrary commands to run as the Oracle user. This is documented in the NVD entry and reflected in related Nessus/NVD references.

CVE-2004-1368

The CVE-2004-1368 entry affects Oracle ISQL*Plus in Oracle 10g Application Server. The vulnerability allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script, enabling potential arbitrary-file execution on the affected server. The ac...

CVE-2004-1370

CVE-2004-1370 is a set of confirmed SQL injection vulnerabilities in Oracle 9i/10g that affect PL/SQL procedures running with definer rights. The flaws allow remote attackers to execute arbitrary SQL commands and potentially gain privileges via the following procedures: DBMS_EXPORT_EXTENSION, WK_...

CVE-2004-1362

CVE-2004-1362 affects the PL/SQL module of the Oracle HTTP Server in Oracle Application Server 10g when using the WE8ISO8859P1 character set. The issue is a character conversion flaw that allows remote attackers to bypass access restrictions for certain procedures via an encoded URL containing “%...

CVE-2012-3219

Oracle EM/Database Control Segment Advisor vulnerability (CVE-2012-3219) involves an arbitrary URL redirection/phishing flaw in the EM Segment Advisor page. Affected products match the CVE entry: Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3...

CVE-2013-0374

Summary (CVE-2013-0374) : A SQL Injection vulnerability exists in Oracle Enterprise Manager components, specifically in the dBClone path of the OEM web application. Affected: Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5,...

CVE-2015-4735

CVE-2015-4735 affects Oracle Enterprise Manager Grid Control (RAC Management) in EM Base Platform 11.1.0.1 and EM DB Control 11.2.0.3/11.2.0.4. The vulnerability allows remote, unauthenticated access via HTTP to read a subset of data, compromising confidentiality. Public sources in connected docu...

CVE-2013-3791

Oracle Enterprise Manager Grid Control: CVE-2013-3791 corresponds to a cross‑site scripting vulnerability in the Oracle Enterprise Manager Grid Control/EM Base Platform 10.2.0.5 and EM DB Control 11.1.0.7, due to flaws in the UI Framework. Affected products include Enterprise Manager Grid Control...

CVE-2013-0372

CVE-2013-0372 affects Oracle Enterprise Manager products (EM Base Platform/Grid Control and EM DB Control) with an SQL Injection vulnerability in the advReplicationAdmin path of the OEM web application, enabling remote attackers to execute SQL in the backend database. Affected versions include EM...

CVE-2014-6488

CVE-2014-6488 affects Oracle Enterprise Manager components (Grid Control EM Base Platform: 10.2.0.5, 11.1.0.1; EM DB Control: 11.1.0.7, 11.2.0.3, 11.2.0.4; EM Plugin for DB: 12.1.0.4–12.1.0.6) in the Content Management sub-component. The vulnerability is described as unspecified with remote authe...

CVE-2013-0355

The CVE-2013-0355 issue corresponds to a cross-site scripting vulnerability in Oracle Enterprise Manager components (EM Base Platform and EM DB Control) affecting versions 11.1.0.7, 11.2.0.2, and 11.2.0.3, related to the Distributed/Cross DB Features. The TeamSHATTER advisory documents a remote-e...

CVE-2013-3758

Technical details about CVE-2013-3758 are not publicly available in the provided documents; monitor for updates from Oracle and security advisories.

CVE-2012-5062

CVE-2012-5062 involves an unspecified vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3. The issue allows remote attackers to affect i...

CVE-2013-0373

CVE-2013-0373 affects Oracle Enterprise Manager products: EM Base Platform 10.2.0.5 and 11.1.0.1; EM Database Control 10.2.0.3/4/5, 11.1.0.7, 11.2.0.2/3; and EM Plugin for DB 12.1.0.1/12.1.0.2. The vulnerability is SQL Injection in the OEM streams queue path, enabling remote exploitation to execu...

CVE-2013-0353

CVE-2013-0353 affects Oracle Enterprise Manager Grid Control EM Base Platform and related EM components. The TeamSHATTER advisory documents a SQL Injection vulnerability in the EM web application (notably /em/console/ecm/config/savedConfig) that can be exploited remotely to execute statements wit...

CVE-2015-2646

CVE-2015-2646 affects Oracle Enterprise Manager Grid Control Content Management. The vulnerability lies in the Content Management component and can impact integrity; affected products include EM Base Platform 11.1.0.1, EM Plugin for DB 12.1.0.5–12.1.0.7, and EM DB Control 11.1.0.7, 11.2.0.3, 11.2...

CVE-2013-0358

CVE-2013-0358 is supported by a TeamSHATTER advisory detailing a SQL Injection in Oracle Enterprise Manager (Resource Manager) affecting OEM Database Control 10.2.0.3/10.2.0.4/10.2.0.5, 11.1.0.7, 11.2.0.2/11.2.0.3 and EM Plugin for DB 12.1.0.1/12.1.0.2. The issue arises from vulnerable parameters...

CVE-2013-5828

CVE-2013-5828 affects Oracle Enterprise Manager Grid Control and related components. Specifically, the Enterprise Manager Base Platform components EM Base Platform (versions 10.2.0.5 and 11.1.0.1), EM DB Control (11.1.0.7, 11.2.0.2, 11.2.0.3), and the EM Plugin for DB (12.1.0.2 and 12.1.0.3) are ...

CVE-2013-5766

CVE-2013-5766 affects Oracle Enterprise Manager Grid Control/DB Control and the DB Plugin for 12.1.x. Affected components include EM Base Platform (10.2.0.5, 11.1.0.1), EM DB Control (11.1.0.7, 11.2.0.2, 11.2.0.3), and EM Plugin for DB (12.1.0.2–12.1.0.3). The description notes an unspecified rem...

CVE-2013-3762

CVE-2013-3762 corresponds to an unspecified vulnerability in Oracle Enterprise Manager Grid Control EM Base Platform and related components (EM Base Platform 10.2.0.5/11.1.0.1; EM DB Control 11.1.0.7/11.2.0.2/11.2.0.3; EM Plugin for DB 12.1.0.2/12.1.0.3/12.1.0.4) that allows remote attackers to a...

CVE-2015-2647

CVE-2015-2647 affects Oracle Enterprise Manager Grid Control and related EM components (EM Base Platform 11.1.0.1; EM Plugin for DB 12.1.0.5/6/7; EM DB Control 11.1.0.7, 11.2.0.3/4) as described in the SUSE security bulletin. The vulnerability is located in the Content Management subcomponent and...

CVE-2013-5827

CVE-2013-5827 affects Oracle Enterprise Manager Grid Control EM Base Platform (10.2.0.5, 11.1.0.1), EM DB Control (11.1.0.7, 11.2.0.2, 11.2.0.3) and EM Plugin for DB (12.1.0.2). The vulnerability is described as an unspecified issue in the Storage Management area that could allow remote attackers...

CVE-2013-0352

Oracle CVE-2013-0352 describes a Cross‑Site Scripting vulnerability in Oracle Enterprise Manager components, specifically the EM Database Control/XML Database Resources page via the cancelURL parameter. An attacker could remotely exploit this to steal session cookies and impersonate a legitimate ...

CVE-2013-0354

CVE-2013-0354 affects Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and EM DB Control 11.1.0.7, 11.2.0.2, 11.2.0.3. The TeamSHATTER advisory documents a HTTP Response Splitting vulnerability in policyViewSettings that is remotely exploitable; an attacker convincing a valid user...