CVSS: 9.0EPSS: 3%CPEs: 2EXPL: 0CVE-2006-5332
https://notcve.org/view.php?id=CVE-2006-5332
Unspecified vulnerability in xdb.dbms_xdbz in the XMLDB component for Oracle Database 9.2.0.6 and 10.1.0.4 has unknown impact and remote authenticated attack vectors, aka Vuln# DB01. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB01 is for PL/SQL injection in the ENABLE_HIERARCHY_INTERNAL procedure. Vulnerabilidad no especificada en xdb.dbms_xdbz en el componente XMLDB para Oracle Database 9.2.0.6 y 10.1.0.4 tiene impacto y vectores de ataque remotos autenticados desconocidos, también conocido como Vuln# DB01. NOTA: a fecha del 23/10/2006, Oracle no ha negado los informes de terceras partes fiables de que DB01 es una inyección PL/SQL en el procedimiento ENABLE_HIERARCHY_INTERNAL. • http://secunia.com/advisories/22396 http://securitytracker.com/id?1017077 http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf http://www.kb.cert.org/vuls/id/717140 http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_xdbz0.html http://www.securityfocus.com/archive/1/449110/100/0/threaded http://www.securityfoc •
CVSS: 7.1EPSS: 1%CPEs: 3EXPL: 0CVE-2006-5334
https://notcve.org/view.php?id=CVE-2006-5334
Unspecified vulnerability in Oracle Spatial component in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and remote authenticated attack vectors related to mdsys.md2, aka Vuln# DB03. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB03 is related to one or more of (1) a buffer overflow in the (a) RELATE function or (2) SQL injection in the (b) TESSELATE_FIXED and (c) TESSELATE function. Vulnerabilidad no especificada en el componente Oracle Spatial en Oracle Database 9.0.1.5, 9.2.0.7, y 10.1.0.5 tiene impacto y vectores de ataque remotos autenticados desconocidos relacionado con mdsys.md2, también conocido como Vuln# DB03. NOTA: a fecha del 23/10/2006, Oracle no ha negado los informes de terceras partes fiables de queDB03 está relacionado con uno o más de (1) un desbordamiento de búfer en la función (a) RELATE o (2) inyección SQL en las funciones (b) RESSELATE_FIXED y (c) TESSELATE. • http://secunia.com/advisories/22396 http://securitytracker.com/id?1017077 http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html http://www.securityfocus.com/archive/1/449110/100/0/threaded http://www.securityfocus.com/archive/1/449711/100/0/threaded http://www.securityfocus.com/bid/20588 http://www.us-cert.gov/cas/techalerts/ •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 0CVE-2006-5336
https://notcve.org/view.php?id=CVE-2006-5336
Multiple unspecified vulnerabilities in the Change Data Capture (CDC) component in Oracle Database 9.2.0.7, 10.1.0.5, and have unknown impact and remote authenticated attack vectors related to (1) sys.dbms_cdc_ipublish (Vuln# DB05) and (2) sys.dbms_cdc_isubscribe (DB06). NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB05 is for SQL injection in CREATE_CHANGE_TABLE and CHANGE_TABLE_TRIGGER, and DB06 is for PL/SQL injection in the PREPARE_UNBOUNDED_VIEW procedure. Múltiples vulnerabilidades no especificadas en el componente Change Data Capture (CDC) en Oracle Database 9.2.0.7, 10.1.0.5, tienen impacto y vectores de ataque remotos autenticados desconocidos relacionados con (1) sys.dbms_cdc_ipublish (Vuln# DB05) y (2) sys.dbms_cdc_isubscribe (DB06). NOTA: a fecha del 23/10/2006, Oracle no ha negado los informes de terceras partes fiables de que DB05 es una inyección SQL en CREATE_CHANGE_TABLE y CHANGE_TABLE_TRIGGER, y DB06 es una inyección PL/SQL en el procedimiento PREPARE_UNBOUNDED_VIEW. • http://secunia.com/advisories/22396 http://securitytracker.com/id?1017077 http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf http://www.kb.cert.org/vuls/id/446100 http://www.kb.cert.org/vuls/id/716964 http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html http://www.securityfocus.com/archive/1/449110/100/0/threaded http://www.securityfocus.com/archive/1/449711/100/0/ •
CVSS: 7.1EPSS: 75%CPEs: 5EXPL: 0CVE-2006-5340
https://notcve.org/view.php?id=CVE-2006-5340
Multiple unspecified vulnerabilities in Oracle Spatial component in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) mdsys.sdo_lrs, aka Vuln# DB13, and (2) Vuln# DB17. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB13 is related to bypassing input validation for SQL injection related to convert_to_lrs_layer and dbms_assert, and DB17 is related to SQL injection in the trigger in the SDO_DROP_USER package. Múltiples vulnerabilidades no especificadas en el componente Oracle Spatial en Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.8, 10.1.0.5 y 10.2.0.2 tiene impacto y vectores de ataque remoto autenticado remoto relacionado con (1) mdsys.sdo_lrs, también conocida como Vuln# DB13 y (2) Vuln# DB17. NOTA: a partir de 20061023, Oracle no ha disputado informes de terceras partes confiables sobre que DB13 está relacionado con eludir la validación de entrada para inyección SQL relacionada con convert_to_lrs_layer y dbms_assert y DB17 está relacionado con inyección SQL en el disparador en el paquete SDO_DROP_USER. • http://archive.cert.uni-stuttgart.de/archive/bugtraq/2006/07/msg00489.html http://archive.cert.uni-stuttgart.de/archive/bugtraq/2006/07/msg00500.html http://secunia.com/advisories/22396 http://securitytracker.com/id?1017077 http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf http://www.kb.cert.org/vuls/id/869292 http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html http://www. •
CVSS: 9.0EPSS: 2%CPEs: 3EXPL: 0CVE-2006-5341
https://notcve.org/view.php?id=CVE-2006-5341
Multiple unspecified vulnerabilities in XMLDB component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors, aka (1) Vuln# DB14 and (2) DB15 related to xdb.dbms_xdbz. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB14 is for SQL injection in the PITRIG_DROP and PITRIG_DROPMETADATA functions in XDB_PITRIG_PKG, and DB15 is for SQL injection in DISABLE_HIERARCHY_INTERNAL in DBMS_XDBZ. Múltiples vulnerabilidades no especificadas en el componente XMLDB en Oracle Database 9.2.0.8, 10.1.0.5 y 10.2.0.2 tiene impacto y vectores de ataque remoto autenticado remoto, también conocida como (1) Vuln# DB14 y (2) DB15 relacionado con xdb.dbms_xdbz. NOTA: a partir de 20061023, Oracle no ha disputado informes de terceras partes confiables sobre que DB14 es para inyección SQL en las funciones PITRIG_DROP y PITRIG_DROPMETADATA en XDB_PITRIG_PKG y DB15 es para inyección SQL en DISABLE_HIERARCHY_INTERNAL en DBMS_XDBZ. • http://secunia.com/advisories/22396 http://securitytracker.com/id?1017077 http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf http://www.kb.cert.org/vuls/id/318764 http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html http://www.red-database-security.com/advisory/oracle_cpu_oct_2006.html http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_xdbz0.html http://www.securityfocus.com/archive/1/449110/100/0/threaded http://www.securityfoc •