CVE Vulnerability Catalog

Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2. The flaw has unknown impact and attack vectors, identified as Oracle Vuln# OHS02.

Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal versions 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2. Attackers may exploit unknown vectors leading to unspecified impacts.

An unspecified vulnerability in the Change Data Capture component of Oracle Database versions 9.2.0.7, 10.1.0.5, and 10.2.0.1 allows SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package. Details are not officially disclosed by Oracle, but a reliable independent researcher has confirmed the flaw.

Unspecified vulnerability in the Connection Manager component of Oracle Database server versions 8.1.7.4 and 9.0.1.5. May lead to unknown security impacts.

Multiple unspecified vulnerabilities were found in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 in the Dictionary and Oracle Label Security components. One of them (DB07) allows the TDE wallet password to be stored in plaintext in a trace file generated by event 10053.

Multiple unspecified vulnerabilities in Oracle Database versions 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 were found in the Oracle Text and Program Interface Network components. These vulnerabilities may allow SQL injection attacks in functions such as VALIDATE_STATEMENT, BUILD_DML, CLEAN_DML, GET_ROWID, BROWSE_WORDS, and ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE.

Unspecified vulnerability in the Query Optimizer component of Oracle Database server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5. The flaw has unknown impact and attack vectors, identified by Oracle as DB19.

Unspecified vulnerability in the Security component of Oracle Database server versions 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4. May lead to unknown security impacts on the database.

Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10, affecting the Oracle Reports Developer component. Oracle has not disputed researcher claims that REP05 and REP06 correspond to CVE-2005-2378 and CVE-2005-2371, both involving directory traversal.

Multiple unspecified vulnerabilities were identified in Oracle E-Business Suite and Applications 11.5.9 within the CRM Technical Foundation, iProcurement, and Oracle Application Object Library components. Their impact and attack vectors are unknown.

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4. A reliable independent researcher claims it is SQL injection in the DBMS_REGISTRY package in functions IS_COMPONENT, GET_COMP_OPTION, DISABLE_DDL_TRIGGERS, SCRIPT_EXISTS, COMP_PATH, GATHER_STATS, NOTHING_SCRIPT, and VALIDATE_COMPONENTS.

Unspecified vulnerability in the XML Database component of Oracle Database 9.2.0.7 and 10.1.0.4. Likely a buffer overflow in DBMS_XMLSCHEMA and DBMS_XMLSCHEMA_INT packages, exploitable via long arguments to GENERATESCHEMA or GENERATESCHEMAS.

Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), affecting Email Server, Wireless & Voice, Content Management SDK, and Content Services components. The flaws have unknown impact and attack vectors, identified as OCS01-OCS15.

Multiple unspecified vulnerabilities were discovered in Oracle E-Business Suite and Applications 4.3 within the Oracle iLearning component. These flaws, identified as APPS13 and APPS14, have unknown impact and attack vectors.

Multiple unspecified vulnerabilities were found in Oracle Database versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 in the Net Listener and Network Communications (RPC) components. The impact and attack vectors are not detailed.

Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5 and Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2. An attacker could exploit this flaw causing unspecified security impact.

An unspecified vulnerability in context.py in the Albatross web application toolkit before version 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the handling of submitted form fields.

SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter ($tmpCategory variable), enabling credential theft and file uploads.

SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the year, month, and day parameters.

The vulnerability in Check Point VPN-1 SecureClient is due to an unquoted Windows search path. A local user can place a malicious "program.exe" file in the C:\ directory, which will be executed instead of the intended Sr_GUI.exe program.