CVSS: 5.0EPSS: 1%CPEs: 13EXPL: 0CVE-2004-2244
https://notcve.org/view.php?id=CVE-2004-2244
The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service (CPU and memory consumption) via a SOAP message containing a crafted DTD. • http://otn.oracle.com/deploy/security/pdf/2004alert65.pdf http://secunia.com/advisories/10936 http://www.osvdb.org/4011 http://www.securityfocus.com/bid/9703 https://exchange.xforce.ibmcloud.com/vulnerabilities/15270 •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2004-1338
https://notcve.org/view.php?id=CVE-2004-1338
The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions. • http://marc.info/?l=bugtraq&m=110382230614420&w=2 http://www.ngssoftware.com/advisories/oracle23122004I.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/18655 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2004-1339
https://notcve.org/view.php?id=CVE-2004-1339
SQL injection vulnerability in the (1) MDSYS.SDO_GEOM_TRIG_INS1 and (2) MDSYS.SDO_LRS_TRIG_INS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.table_name or new.column_name parameters. • http://marc.info/?l=bugtraq&m=110382230614420&w=2 http://www.ngssoftware.com/advisories/oracle23122004I.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/18655 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 11CVE-2003-1208
https://notcve.org/view.php?id=CVE-2003-1208
Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions. • http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.html http://secunia.com/advisories/10805 http://www.ciac.org/ciac/bulletins/o-093.shtml http://www.kb.cert.org/vuls/id/240174 http://www.kb.cert.org/vuls/id/399806 http://www.kb.cert.org/vuls/id/819126 http://www.kb.cert.org/vuls/id/846582 http://www.nextgenss.com/advisories/ora_from_tz.txt http://www.nextgenss.com/advisories/ora_numtodsinterval.txt http://www.nextgenss.com/advisories/ora_num •
CVSS: 6.5EPSS: 95%CPEs: 6EXPL: 1CVE-2004-0637 – Oracle Database Server 8.1.7/9.0.x - ctxsys.driload Access Validation
https://notcve.org/view.php?id=CVE-2004-0637
Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible. • https://www.exploit-db.com/exploits/24567 http://secunia.com/advisories/12409 http://www.idefense.com/application/poi/display?id=136&type=vulnerabilities&flashstatus=true http://www.kb.cert.org/vuls/id/316206 http://www.securityfocus.com/bid/11099 • CWE-94: Improper Control of Generation of Code ('Code Injection') •