CVSS: 10.0EPSS: 26%CPEs: 1EXPL: 3CVE-2006-3698 – Oracle 10g - SYS.KUPW$WORKER.MAIN PL / SQL Injection
https://notcve.org/view.php?id=CVE-2006-3698
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER. Múltiples vulnerabilidades no especificadas en Oracle Database 10.1.0.5 tienen un impacto desconocido y vectores de ataque, también conocido como Oracle Vuln# (1) DB01 para el componente Change Data Capture (CDC) y (2) DB03 para Data Pump Metadata API. NOTA: en fecha de 20060719, Oracle no ha cuestionado la demanda de un investigador confiable que DB01 está relacionado con múltiples vulnerabilidades de inyección SQL en SYS.DBMS_CDC_IMPDP utilizando los procedimientos (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, y (j) VALIDATE_SUBSCRIPTION, y que DB03 es para inyección SQL en el proceso MAIN para SYS.KUPW$WORKER. • https://www.exploit-db.com/exploits/3178 https://www.exploit-db.com/exploits/3358 https://www.exploit-db.com/exploits/3375 http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047994.html http://secunia.com/advisories/21111 http://secunia.com/advisories/21165 http://securitytracker.com/id?1016529 http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html http://www.red-database-security •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3705
https://notcve.org/view.php?id=CVE-2006-3705
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB21 for Statistics and (2) DB22 for Upgrade & Downgrade. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection vulnerability in SYS.DBMS_STATS, and that DB22 is for SQL injection in SYS.DBMS_UPGRADE. Múltiples vulnerabilidades no especificadas en Oracle Database 10.1.0.5 tiene un impacto desconocido y vectores de ataque, también conocido como Oracle Vuln# (1) DB21 para Statistics y (2) DB22 para Upgrade & Downgrade. NOTA: en fecha 20060719, Oracle no ha disputado este asunto por un investigador creible que DB21 es para vulnerabildades de inyección SQL local en SYS.DBMS_STATS, y que DB22 es para inyección SQL en SYS.DBMS_UPGRADE. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047992.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047993.html http://secunia.com/advisories/21111 http://secunia.com/advisories/21165 http://securityreason.com/securityalert/1251 http://securitytracker.com/id?1016529 http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html http://www.red-database-security.com/advisory/ora •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2006-3702
https://notcve.org/view.php?id=CVE-2006-3702
Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB06 in Export; (2) DB08, (3) DB09, (4) DB10, (5) DB11, (6) DB12, (7) DB13, (8) DB14, and (9) DBC01 for OCI; (10) DB16 for Query Rewrite/Summary Mgmt; (11) DB17, (12) DB18, (13) DB19, (14) DBC02, (15) DBC03, and (16) DBC04 for RPC; and (17) DB20 for Semantic Analysis. NOTE: as of 20060719, Oracle has not disputed third party claims that DB06 is related to "SQL injection" using DBMS_EXPORT_EXTENSION with a modified ODCIIndexGetMetadata routine and a call to GET_DOMAIN_INDEX_METADATA, in which case DB06 might be CVE-2006-2081. Múltiples vulnerabilidades no especificadas en Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, y 10.2.0.2 tienen un impacto desconocido y vectores de ataque, también conocido como Oracle Vuln# (1) DB06 en Export; (2) DB08, (3) DB09, (4) DB10, (5) DB11, (6) DB12, (7) DB13, (8) DB14, and (9) DBC01 para Query Rewrite/Summary Mgmt; (11) DB17, (12) DB18, (13) DB19, (14) DBC02, (15) DBC03, y (16) DBC04 para RPC; y(17) DB20 para Semantic Analysis. NOTA: en fecha 20060719, Oracle no ha disputado a terceros que DB06 está relacionado con la “inyección SQL” utilizando DBMS_EXPORT_EXTENSION con una rutina ODCIIndexGetMetadata y una llamada a GET_DOMAIN_INDEX_METADATA, en cuyo caso DB06 podría estar CVE-2006-2081. • http://secunia.com/advisories/21111 http://secunia.com/advisories/21165 http://securitytracker.com/id?1016529 http://www.kb.cert.org/vuls/id/932124 http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html http://www.securityfocus.com/archive/1/440758/100/100/threaded http://www.securityfocus.com/bid&# •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2006-3699
https://notcve.org/view.php?id=CVE-2006-3699
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5 and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB02. Vulnerabilidad no especificada en el componente Core RDBMS en Oracle Database 9.0.1.5 y 9.2.0.6 tiene un impacto desconocido y vectores de ataque, también conocido como Oracle Vuln# DB02. • http://secunia.com/advisories/21111 http://secunia.com/advisories/21165 http://securitytracker.com/id?1016529 http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html http://www.securityfocus.com/archive/1/440758/100/100/threaded http://www.securityfocus.com/bid/19054 http://www.us-cert.gov/cas/techalerts/TA06-200A.html http://www.vupen.com/english/advisories/2006/2863 http://www.vupen.c •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 0CVE-2006-3701
https://notcve.org/view.php?id=CVE-2006-3701
Unspecified vulnerability in the Dictionary component in Oracle Database 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB05. Vulnerabilidad no especificada en el componente Dictionary en Oracle Database 8.1.7.4, 9.0.1.5, y 9.2.0.6 tiene un impacto desconocido y vectores de ataque, también conocido como Oracle Vuln# DB05. • http://secunia.com/advisories/21111 http://secunia.com/advisories/21165 http://securitytracker.com/id?1016529 http://www.oracle.com/technetwork/topics/security/cpujul2006-101315.html http://www.red-database-security.com/advisory/oracle_cpu_july_2006.html http://www.securityfocus.com/archive/1/440758/100/100/threaded http://www.securityfocus.com/bid/19054 http://www.us-cert.gov/cas/techalerts/TA06-200A.html http://www.vupen.com/english/advisories/2006/2863 http://www.vupen.c •