CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0986
https://notcve.org/view.php?id=CVE-2009-0986
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. Vulnerabilidad no especificada en el componente Workspace Manager en Oracle Database v10.2.0.4 y v11.1.0.6 permite a usuarios autenticados remotamente afectar a la confidencialidad, integridad, y disponibilidad a través de vectores desconocidos. • http://osvdb.org/53735 http://secunia.com/advisories/34693 http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html http://www.securityfocus.com/bid/34461 http://www.securitytracker.com/id?1022052 http://www.us-cert.gov/cas/techalerts/TA09-105A.html •
CVSS: 5.5EPSS: 8%CPEs: 3EXPL: 0CVE-2009-0992
https://notcve.org/view.php?id=CVE-2009-0992
Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is SQL injection in the DEQ_EXEJOB procedure. Vulnerabilidad no especificada en el componente Advanced Queuing en Oracle Database v10.1.0.5, v10.2.0.4, y v11.1.0.7 que permite a los usuarios remotos autenticados afectar a la confidencialidad e integridad, en relación a DBMS_AQIN. • http://secunia.com/advisories/34693 http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqin.html http://www.securityfocus.com/archive/1/502723/100/0/threaded http://www.securityfocus.com/bid/34461 http://www.securitytracker.com/id?1022052 http://www.us-cert.gov/cas/techalerts/TA09-105A.html •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0979
https://notcve.org/view.php?id=CVE-2009-0979
Unspecified vulnerability in the Resource Manager component in Oracle Database 9.2.0.8 and 9.2.0.8DV allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. Vulnerabilidad no especificada en el componente Resource Manager en Oracle Database v9.2.0.8 y v9.2.0.8DV permite a usuarios remotos autenticados afectar a la confidencialidad, integridadad y disponibilidad mediante vectores desconocidos. • http://secunia.com/advisories/34693 http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html http://www.securityfocus.com/bid/34461 http://www.securitytracker.com/id?1022052 http://www.us-cert.gov/cas/techalerts/TA09-105A.html •
CVSS: 5.1EPSS: 2%CPEs: 3EXPL: 1CVE-2008-6065 – Oracle Database Server 11.1 - 'CREATE ANY Directory' Privilege Escalation
https://notcve.org/view.php?id=CVE-2008-6065
Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory, and then overwriting the password file through UTL_FILE operations, a related issue to CVE-2006-7141. Oracle Database Server v10.1, v10.2, y 11g concede permisos WRITE al directorio para rutas arbitrarias que están relacionadas con un estado CREATE OR REPLACE DIRECTORY, lo cual permite a usuarios autenticados con privilegios CREATE ANY DIRECTORY conseguir privilegios SYSDBA enlazando la ruta del directorio contraseña, y entonces sobre escribir el fichero contraseña a través de operaciones UTL_FILE, una cuestión relacionada con CVE-2006-7141. • https://www.exploit-db.com/exploits/32475 http://www.oracleforensics.com/wordpress/index.php/2008/10/10/create-any-directory-to-sysdba http://www.oracleforensics.com/wordpress/wp-content/uploads/2008/10/create-any-directory-to-sysdba.pdf http://www.securityfocus.com/archive/1/497286/100/0/threaded http://www.securityfocus.com/bid/31738 https://exchange.xforce.ibmcloud.com/vulnerabilities/48814 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 1%CPEs: 3EXPL: 0CVE-2008-3999
https://notcve.org/view.php?id=CVE-2008-3999
Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 allows remote authenticated users to affect availability, related to SYS.OLAPIMPL_T. Vulnerabilidad sin especificar en el componente Oracle OLAP en Oracle Database v9.2.0.8, v9.2.0.8DV, y v10.1.0.5 permite a usuarios autenticados remotamente afectar a la disponibilidad, relacionado con SYS.OLAPIMPL_T. • http://osvdb.org/51349 http://secunia.com/advisories/33525 http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html http://www.securityfocus.com/bid/33177 http://www.securitytracker.com/id?1021561 http://www.vupen.com/english/advisories/2009/0115 •