CVSS: 7.5EPSS: 9%CPEs: 22EXPL: 3CVE-2006-0586 – Oracle 10g - SYS.KUPV$FT.ATTACH_JOB PL / SQL Injection
https://notcve.org/view.php?id=CVE-2006-0586
Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues. Múltiples vulnerabilidades de inyección SQL en Oracle 10g Release 1 en versiones anteriores a CPU de Enero de 2006 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través de parámetros múltiples en funciones (1) ATTACH_JOB, (2) HAS_PRIVS y (3) OPEN_JOB en el paquete SYS.KUPV$FT; y funciones (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK y (16) VALID_HANDLE en el paquete SYS.KUPV$FT_INT. NOTA: debido a la falta de detalles relevantes en la recomendación de Oracle, se está creando una CVE separada ya que no se puede probar concluyentemente que estas cuestiones hayan sido dirigidas por Oracle. • https://www.exploit-db.com/exploits/3179 https://www.exploit-db.com/exploits/3359 https://www.exploit-db.com/exploits/3376 http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041498.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041499.html http://www.osvdb.org/22839 http://www.osvdb.org/22840 http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html http://www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft&# • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 2%CPEs: 60EXPL: 0CVE-2006-0552
https://notcve.org/view.php?id=CVE-2006-0552
Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11. • http://secunia.com/advisories/18493 http://secunia.com/advisories/18608 http://securitytracker.com/id?1015499 http://www.kb.cert.org/vuls/id/545804 http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html http://www.osvdb.org/22549 http://www.securityfocus.com/bid/16287 http://www.vupen.com/english/advisories/2006/0243 http://www.vupen.com/english/advisories/2006/0323 https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 •
CVSS: 7.5EPSS: 1%CPEs: 40EXPL: 0CVE-2006-0435
https://notcve.org/view.php?id=CVE-2006-0435
Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041898.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041899.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041742.html http://secunia.com/advisories/18621 http://secunia.com/advisories/19712 http://secunia.com/advisories/19859 http://securityreason.com/securityalert/402 http://securityreason.com/securityalert/403 http://securitytracker.com/id?1015544 http://securitytracker.com/id?10 •
CVSS: 10.0EPSS: 1%CPEs: 7EXPL: 0CVE-2006-0285
https://notcve.org/view.php?id=CVE-2006-0285
Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# JN01. • http://secunia.com/advisories/18493 http://secunia.com/advisories/18608 http://securitytracker.com/id?1015499 http://www.kb.cert.org/vuls/id/545804 http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html http://www.securityfocus.com/bid/16287 http://www.vupen.com/english/advisories/2006/0243 http://www.vupen.com/english/advisories/2006/0323 https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 •
CVSS: 10.0EPSS: 1%CPEs: 7EXPL: 0CVE-2006-0286
https://notcve.org/view.php?id=CVE-2006-0286
Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS01. • http://secunia.com/advisories/18493 http://secunia.com/advisories/18608 http://securitytracker.com/id?1015499 http://www.kb.cert.org/vuls/id/545804 http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html http://www.securityfocus.com/bid/16287 http://www.vupen.com/english/advisories/2006/0243 http://www.vupen.com/english/advisories/2006/0323 https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 •