CVSS: 7.8EPSS: 0%CPEs: 87EXPL: 0CVE-2004-1365
https://notcve.org/view.php?id=CVE-2004-1365
04 Aug 2004 — Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user. • http://marc.info/?l=bugtraq&m=110382471608835&w=2 •
CVSS: 9.8EPSS: 1%CPEs: 87EXPL: 0CVE-2004-1370
https://notcve.org/view.php?id=CVE-2004-1370
04 Aug 2004 — Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2) WK_ACL.GET_ACL, (3) WK_ACL.STORE_ACL, (4) WK_ADM.COMPLETE_ACL_SNAPSHOT, (5) WK_ACL.DELETE_ACLS_WITH_STATEMENT, or (6) DRILOAD.VALIDATE_STMT. • http://marc.info/?l=bugtraq&m=110382596129607&w=2 •
CVSS: 9.1EPSS: 2%CPEs: 87EXPL: 0CVE-2004-1362
https://notcve.org/view.php?id=CVE-2004-1362
04 Aug 2004 — The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters. • http://marc.info/?l=bugtraq&m=110382306006205&w=2 •
CVSS: 9.8EPSS: 20%CPEs: 70EXPL: 2CVE-2004-1707 – Oracle9i Database - Default Library Directory Privilege Escalation
https://notcve.org/view.php?id=CVE-2004-1707
30 Jul 2004 — The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0. • https://www.exploit-db.com/exploits/24335 •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2003-1193
https://notcve.org/view.php?id=CVE-2003-1193
03 Nov 2003 — Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL. • http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf •
CVSS: 9.8EPSS: 12%CPEs: 31EXPL: 0CVE-2003-0222
https://notcve.org/view.php?id=CVE-2003-0222
30 Apr 2003 — Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter. Desbordamiento de búfer basado en la pila en Oracle Net Sevices de Oracle Database Server 9i release 2 y anteriores permite a atacantes ejecutar código arbitrario mediante una consulta "CREATE DATABASE LINK" conteniendo una cadena de conexión con un parámetro USING largo. • http://marc.info/?l=bugtraq&m=105162831008176&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 6%CPEs: 7EXPL: 0CVE-2002-1264
https://notcve.org/view.php?id=CVE-2002-1264
12 Nov 2002 — Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL. Desbordamiento de búfer en la aplicación web Oracle iSQL*Plus del servidor de bases de datos Oracle 9 permite a atacantes remotos ejecutar código arbitrario mediante un parámetro de ID de usuario largo en la URL isqlplus • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0060.html •
CVSS: 7.5EPSS: 1%CPEs: 18EXPL: 1CVE-2002-1118
https://notcve.org/view.php?id=CVE-2002-1118
28 Oct 2002 — TNS Listener in Oracle Net Services for Oracle 9i 9.2.x and 9.0.x, and Oracle 8i 8.1.x, allows remote attackers to cause a denial of service (hang or crash) via a SERVICE_CURLOAD command. El escuchador TNS en Oracle Net Services de Oracle 9i 9.2.x y 9.0.x, y Oracle 8i 8.1.x, permite a atacantes remotos causar una denegación de servicio (cuelgue o caída) mediante un comando SERVICE_CURLOAD. • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0017.html •