CVE Vulnerability Catalog

Oracle Database 10.1.0.5 contains multiple unspecified vulnerabilities with unknown impact and attack vectors, identified as Oracle Vuln# DB21 (Statistics) and DB22 (Upgrade & Downgrade). According to a reliable researcher, DB21 is a local SQL injection vulnerability in SYS.DBMS_STATS, and DB22 is SQL injection in SYS.DBMS_UPGRADE.

Unspecified vulnerability in the Oracle ODBC Driver for Oracle Database 10.1.0.4 has unknown impact and attack vectors, aka Oracle Vuln# 10.1.0.4.

Unspecified vulnerability in InterMedia for Oracle Database 9.0.1.5, 9.2.0.6, and 10.1.0.4 has unknown impact and attack vectors, aka oracle Vuln# DB07.

Oracle Database versions 9.2.0.6 and 10.1.0.4 contain multiple unspecified vulnerabilities with unknown impact and attack vectors. They affect Web Distributed Authoring and Versioning (DAV) and XMLDB components, identified as Oracle Vuln# DB04 and DB23.

Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, specifically in the Change Data Capture (CDC) component and Data Pump Metadata API. According to a researcher, DB01 relates to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP procedures, and DB03 relates to SQL injection in the MAIN procedure for SYS.KUPW$WORKER.

A vulnerability in Agnitum Outpost Firewall Pro 3.51.759.6511 (462), also used in Lavasoft Personal Firewall 1.0.543.5722 (433) and Novell BorderManager Novell Client Firewall 2.0, improperly restricts user activities in application windows running in a LocalSystem context. This allows local users to gain privileges and execute commands via the "open folder" option when no instance of explorer.exe is running, or by overwriting a batch file through the "Save Configuration As" option. It might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.

PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. The vendor has disputed this issue, stating that the $lm_path variable is set to a constant value, and CVE concurs with the vendor based on post-disclosure analysis.

SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id parameter.

FatWire Content Server version 5.5.0 contains a vulnerability that allows remote attackers to bypass access restrictions and obtain administrative privileges through unspecified attack vectors in the authentication process.

The Touch Control ActiveX control version 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files by supplying a "file///" URI in the sPath parameter to the Execute function.

MyBB (MyBulletinBoard) 1.1.4 contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via unspecified vectors.

Unspecified vulnerability in JD Edwards HTML Server for Oracle OneWorld Tools EnterpriseOne Tools 8.95 and 8.96. The impact and attack vectors are unknown, referred to as Oracle Vuln# JDE01.

Unspecified vulnerability in the Dictionary component in Oracle Database 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB05.

Unspecified vulnerability in the Core RDBMS component of Oracle Database versions 9.0.1.5 and 9.2.0.6. The impact and attack vectors are unknown, referred to as Oracle Vuln# DB02.

Unspecified vulnerability in Calendar for Oracle Collaboration Suite 10.1.2. The impact and attack vectors are unknown, and it is referred to as Oracle Vuln# OCS01.

Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, 9.0.4.2, and 10.1.2.0.0 has unknown impact and attack vectors, aka Oracle Vuln# (1) AS05 and (2) AS08.

Unspecified vulnerability in OC4J for Oracle Application Server versions 9.0.2.3, 9.0.3.1, 9.0.4.2, 10.1.2.0.2, and 10.1.2.1. The impact and attack vectors are unknown, known as Oracle Vuln# AS03.

An unspecified vulnerability in the MOUNT dissector in Wireshark (formerly Ethereal) versions 0.9.4 through 0.99.0 allows remote attackers to cause a denial of service through excessive memory consumption. The attack vectors are not specified.

PHP remote file inclusion vulnerability in Include/editor/rich_files/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter.

Multiple unspecified vulnerabilities in Oracle Exchange for Oracle E-Business Suite and Applications 6.2.4 have unknown impact and attack vectors, identified as APPS16 and APPS17.