CVSS: 8.8EPSS: 1%CPEs: 38EXPL: 0CVE-2007-3854
https://notcve.org/view.php?id=CVE-2007-3854
18 Jul 2007 — Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow. Múltiples vulnerabilidades no especificadas en Oracle Database versiones 9.0.1.5+, 9.2.0.7 y 10.1.0.5, permiten a usuarios auten... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 •
CVSS: 8.1EPSS: 10%CPEs: 6EXPL: 0CVE-2007-3856
https://notcve.org/view.php?id=CVE-2007-3856
18 Jul 2007 — Unspecified vulnerability in the Oracle Data Mining component for Oracle Database 10g Release 2 10.2.0.2 and 10.2.0.3, 10g 10.1.0.5, and Oracle9i Database Release 2 9.2.0.7, 9.2.0.8, and 9.2.0.8DV has unknown impact and remote authenticated attack vectors related to DMSYS.DMP_SYS, aka DB04. Vulnerabilidad no especificada en el componente Oracle Data Mining para Oracle Database 10g Release 2 10.2.0.2 y 10.2.0.3, 10g 10.1.0.5, y Oracle9i Database Release 2 9.2.0.7, 9.2.0.8, y 9.2.0.8DV tiene un impacto descon... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 •
CVSS: 9.8EPSS: 4%CPEs: 6EXPL: 0CVE-2007-3859
https://notcve.org/view.php?id=CVE-2007-3859
18 Jul 2007 — Unspecified vulnerability in the Oracle Internet Directory component for Oracle Database 9.2.0.8 and 9.2.0.8DV; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 10.1.2 has unknown impact and remote attack vectors, aka OID01. Vulnerabilidad sin especificar en el componente Oracle Internet Directory para el Oracle Database 9.2.0.8 y 9.2.0.8DV, el Application Server 9.0.4.3, 10.1.2.0.2 y 10.1.2.2 y el Collaboration Suite 10.1.2 tiene un impacto desconocido y vectores de ataque remo... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 •
CVSS: 8.8EPSS: 94%CPEs: 5EXPL: 2CVE-2007-3855 – Oracle 9i/10g - Evil Views Change Passwords
https://notcve.org/view.php?id=CVE-2007-3855
18 Jul 2007 — Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17). NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions. Multiples vulnerabilidades n... • https://www.exploit-db.com/exploits/4203 •
CVSS: 10.0EPSS: 40%CPEs: 4EXPL: 0CVE-2007-3338
https://notcve.org/view.php?id=CVE-2007-3338
22 Jun 2007 — Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions. Múltiples desbordamientos de búfer en la región stack de la memoria en Ingres database server 2006 versiones 9.0.4, r3, 2.6 y 2.5, tal como se usa en varios productos de CA (Computer Associates), permiten a los atacantes remotos ejecutar código arbitrario... • http://osvdb.org/37483 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2007-3337
https://notcve.org/view.php?id=CVE-2007-3337
22 Jun 2007 — wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allows local users to truncate arbitrary files via a symlink attack on the alarmwkp.def file. El inicio (wakeup) en la base de datos Ingres server 2006 9.0.4, r3, 2.6 y 2.5, tal y como se usa en los productos CA (Computer Associates), permite a usuarios locales truncar ficheros de su elección mediante un ataque symlink (de enlaces simbólicos) en el fichero alarmwkp.def. • http://osvdb.org/37485 •
CVSS: 10.0EPSS: 82%CPEs: 4EXPL: 1CVE-2007-3336 – CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)
https://notcve.org/view.php?id=CVE-2007-3336
22 Jun 2007 — Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres Communications Server Process (iigcc), which calls the (1) QUinsert or (2) QUremove functions with attacker-controlled input. Múltiples vulnerabilidades "pointer overwrite" en Ingres database server 2006 versiones 9.0.4, r3, 2.6 y 2.5, t... • https://www.exploit-db.com/exploits/14646 •
CVSS: 9.0EPSS: 1%CPEs: 7EXPL: 0CVE-2007-2130
https://notcve.org/view.php?id=CVE-2007-2130
18 Apr 2007 — Unspecified vulnerability in Workflow Cartridge, as used in Oracle Database Server 9.2.0.1, 10.1.0.2, and 10.2.0.1; Application Server 9.0.4.3 and 10.1.2.0.2; Collaboration Suite 10.1.2; and E-Business Suite; has unknown impact and remote authenticated attack vectors, aka OWF01. Vulnerabilidad no especificada en Workflow Cartridge, tal y como se usa en Oracle Database Server 9.2.0.1, 10.1.0.2, y 10.2.0.1; Application Server 9.0.4.3 y 10.1.2.0.2; Collaboration Suite 10.1.2; y E-Business Suite; tienen un impa... • http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2007-2110
https://notcve.org/view.php?id=CVE-2007-2110
18 Apr 2007 — Unspecified vulnerability in the Core RDBMS component for Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.4 on Windows systems has unknown impact and attack vectors, aka DB03. NOTE: as of 20070424, Oracle has not disputed reliable claims that DB03 occurs because RDBMS uses a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections, which allows local users to inject threads and execute arbitrary code via the OpenProcess, OpenThread, and SetThreadContext functions... • http://www.freelists.org/archives/oracle-l/12-2006/msg00004.html •
CVSS: 6.8EPSS: 7%CPEs: 6EXPL: 0CVE-2007-2119
https://notcve.org/view.php?id=CVE-2007-2119
18 Apr 2007 — Cross-site scripting (XSS) vulnerability in boundary_rules.jsp in the Administration Front End for Oracle Enterprise (Ultra) Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTML or web script via the EXPTYPE parameter, aka SES01. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en boundary_rules.jsp en el Administration Front End para Oracle Enterprise (Ultra) Search,... • http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html •