Oracle Database Server vulnerabilities

Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker with no special privileges and network access via HTTP to gain unauthorized access to critical data or complete access to all RDBMS data.

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).

Vulnerability in the Java VM component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. A difficult to exploit flaw allows a low-privileged attacker with network access via SOCKS5 to perform unauthorized creation, deletion or modification of critical data.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with Create Session privilege to gain unauthorized access to critical data, potentially impacting other products.

Vulnerability in the Oracle OLAP component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable Oracle Net attack allows a low-privileged attacker with DBMS_AW privilege to take over Oracle OLAP.

Vulnerability in the VPD component of Oracle Database Server. A low privileged attacker with Create Table privilege can exploit it over the network via Oracle Net to gain unauthorized creation, deletion or modification access to VPD data. CVSS 8.1.

Vulnerability in the RDBMS component of Oracle Database Server. A low privileged attacker with DBMS_VECTOR privilege can exploit it over the network via Oracle Net to take over RDBMS. CVSS 8.8.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running RDBMS to cause a hang or frequently repeatable crash (complete DOS).

Vulnerability in the RDBMS component of Oracle Database Server versions 19.3-19.32 and 21.3-21.23. An easily exploitable flaw allows a high privileged attacker with Query Optimizer privilege and network access via Oracle Net to gain unauthorized read access to a subset of data.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to compromise RDBMS.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker having Create DB Link privilege with network access via Oracle Net to compromise RDBMS.

Vulnerability in the Oracle Text component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Create Index privilege and network access via Oracle Net can compromise Oracle Text. The vulnerability is difficult to exploit but may impact additional products (scope change).

Vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access via Oracle Net can compromise RDBMS. The vulnerability is easily exploitable.

Vulnerability in the RDBMS component of Oracle Database Server in versions 23.4.0-23.26.3. Easily exploitable, allows attacker with Create Table privilege via Oracle Net to take over RDBMS.

Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with XDKC privilege and network access via Oracle Net can take over Oracle XML Developers Kit.

Vulnerability in the RDBMS component of Oracle Database Server. Affected versions are 23.4.0-23.26.3. Easily exploitable issue allows an attacker with Authenticated User privilege via Oracle Net to cause complete denial of service (hang or frequent crashes) in RDBMS, and attacks may impact additional products.

Vulnerability in the RDBMS component of Oracle Database Server, affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable by unauthenticated attacker over network (Oracle Net). Successful attack can allow unauthorized read access to a subset of data.

Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. A low-privileged attacker (Authenticated User) via Oracle Net, under difficult conditions, can take over the system and impact other products.

Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.

Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.

Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).

Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.

Vulnerability in the JDBC component of Oracle Database Server in versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable flaw requires human interaction and allows a high-privileged attacker with network access via Oracle Net to take over the JDBC component.

Vulnerability in the Java VM component of Oracle Database Server allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to unauthorized create, delete, or modify critical data. The attack is easy to exploit.

Vulnerability in RDBMS component of Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable by high-privileged attacker with network access via Oracle Net. Successful attack may lead to unauthorized data modification.

Vulnerability in the RDBMS component of Oracle Database Server. Affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can exploit it without user interaction. Successful attack allows unauthorized update, insert, or delete access to some RDBMS data, with potential impact on additional products (scope change).

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequent crash (complete DoS) of the service.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequently repeatable crash (complete DOS) of Net Service.

A vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.30. A high-privileged attacker with Row Access Method privilege and network access can exploit it, but human interaction is required. Successful attacks may result in unauthorized read access to a subset of RDBMS data (CVSS 2.4).

Vulnerability in the XML Database component of Oracle Database Server allows an unauthenticated attacker remote access via HTTPS to confidential data. It requires user interaction and is difficult to exploit.

Vulnerability in the Java VM component of Oracle Database Server (versions 19.3-19.28, 21.3-21.19, 23.4-23.9). Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks can result in unauthorized creation, deletion or modification of critical data or all Java VM accessible data. CVSS 5.9 (Integrity impact).

Vulnerability in the Unified Audit component of Oracle Database Server (versions 23.4-23.9). An attacker with DBA privilege and network access via Oracle Net can compromise Unified Audit, potentially leading to unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 2.7.

Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Affected versions are 23.4-23.9. A high privileged attacker with SYSDBA privilege and network access via Oracle Net can compromise RDBMS Functional Index, resulting in unauthorized read access to a subset of data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).

A vulnerability in the Portable Clusterware component of Oracle Database Server allows an unauthenticated attacker with network access via Bonjour to compromise Portable Clusterware. Successful attacks can result in unauthorized read access to a subset of data. Affects versions 19.3-19.28, 21.3-21.19, 23.4-23.9.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Affected versions are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction and may significantly impact additional products. Successful attacks can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces Native Network Encryption changes to address this vulnerability. CVSS 3.1 Base Score 8.3.