CVSS: 9.8EPSS: 4%CPEs: 60EXPL: 0CVE-2006-0552
https://notcve.org/view.php?id=CVE-2006-0552
04 Feb 2006 — Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11. • http://secunia.com/advisories/18493 •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2006-0262
https://notcve.org/view.php?id=CVE-2006-0262
18 Jan 2006 — Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08. • http://secunia.com/advisories/18493 •
CVSS: 10.0EPSS: 1%CPEs: 8EXPL: 0CVE-2006-0271
https://notcve.org/view.php?id=CVE-2006-0271
18 Jan 2006 — Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_... • http://secunia.com/advisories/18493 •
CVSS: 9.8EPSS: 0%CPEs: 101EXPL: 0CVE-2005-3641
https://notcve.org/view.php?id=CVE-2005-3641
16 Nov 2005 — Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication by supplying a valid username. • http://www.ngssoftware.com/papers/database-on-xp.pdf •
CVSS: 6.1EPSS: 37%CPEs: 53EXPL: 2CVE-2005-3204 – Oracle 9 - XML DB Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-3204
14 Oct 2005 — Cross-site scripting (XSS) vulnerability in Oracle XML DB 9iR2 allows remote attackers to inject arbitrary web script or HTML via the query string in an HTTP request. • https://www.exploit-db.com/exploits/26332 •
CVSS: 9.1EPSS: 0%CPEs: 22EXPL: 1CVE-2005-1495
https://notcve.org/view.php?id=CVE-2005-1495
11 May 2005 — Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection. • http://marc.info/?l=bugtraq&m=111531683824209&w=2 •
CVSS: 9.8EPSS: 17%CPEs: 14EXPL: 0CVE-2004-0638
https://notcve.org/view.php?id=CVE-2004-0638
31 Dec 2004 — Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1 8.1.7.4, allows remote authorized users to execute arbitrary code via a long second argument. • http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0178.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2004-1338
https://notcve.org/view.php?id=CVE-2004-1338
23 Dec 2004 — The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions. • http://marc.info/?l=bugtraq&m=110382230614420&w=2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2004-1339
https://notcve.org/view.php?id=CVE-2004-1339
23 Dec 2004 — SQL injection vulnerability in the (1) MDSYS.SDO_GEOM_TRIG_INS1 and (2) MDSYS.SDO_LRS_TRIG_INS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.table_name or new.column_name parameters. • http://marc.info/?l=bugtraq&m=110382230614420&w=2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 2%CPEs: 87EXPL: 0CVE-2004-1362
https://notcve.org/view.php?id=CVE-2004-1362
04 Aug 2004 — The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters. • http://marc.info/?l=bugtraq&m=110382306006205&w=2 •