CVSS: 4.6EPSS: 0%CPEs: 87EXPL: 1CVE-2004-1366
https://notcve.org/view.php?id=CVE-2004-1366
Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges. • http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 http://www.kb.cert.org/vuls/id/316206 http://www.ngssoftware.com/advisories/oracle23122004D.txt http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf http://www.securityfocus.com/archive/1/385323 http://www.securityfocus.com/bid/10871 http://www.us-cert.gov/cas/techalerts/TA04-245A.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18661 • CWE-255: Credentials Management Errors •
CVSS: 4.4EPSS: 0%CPEs: 87EXPL: 0CVE-2004-1367
https://notcve.org/view.php?id=CVE-2004-1367
Oracle 10g Database Server, when installed with a password that contains an exclamation point ("!") for the (1) DBSNMP or (2) SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.log file, which could allow local users to obtain that password and use it against SYS or SYSTEM accounts, which may have been installed with the same password. • http://marc.info/?l=bugtraq&m=110382247308064&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 http://www.kb.cert.org/vuls/id/316206 http://www.ngssoftware.com/advisories/oracle23122004D.txt http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf http://www.us-cert.gov/cas/techalerts/TA04-245A.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 4%CPEs: 87EXPL: 0CVE-2004-1368
https://notcve.org/view.php?id=CVE-2004-1368
ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script. • http://marc.info/?l=bugtraq&m=110382264415387&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 http://www.kb.cert.org/vuls/id/435974 http://www.ngssoftware.com/advisories/oracle23122004E.txt http://www.securityfocus.com/bid/10871 http://www.us-cert.gov/cas/techalerts/TA04-245A.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18656 •
CVSS: 4.6EPSS: 0%CPEs: 87EXPL: 0CVE-2004-1365
https://notcve.org/view.php?id=CVE-2004-1365
Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user. • http://marc.info/?l=bugtraq&m=110382471608835&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 http://www.kb.cert.org/vuls/id/316206 http://www.ngssoftware.com/advisories/oracle23122004C.txt http://www.securityfocus.com/bid/10871 http://www.us-cert.gov/cas/techalerts/TA04-245A.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18662 •
CVSS: 8.5EPSS: 1%CPEs: 87EXPL: 2CVE-2004-1364 – Oracle 9i/10g - 'extproc' Local/Remote Command Execution
https://notcve.org/view.php?id=CVE-2004-1364
Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory. • https://www.exploit-db.com/exploits/2951 https://www.exploit-db.com/exploits/24353 http://marc.info/?l=bugtraq&m=110382406002365&w=2 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1 http://www.0xdeadbeef.info/exploits/raptor_oraextproc.sql http://www.kb.cert.org/vuls/id/316206 http://www.ngssoftware.com/advisories/oracle23122004B.txt http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf http://www.securityfocus.com/archive/1/454861/100/0/ • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •