VYPR
← Oracle Corporation

Vendor CVEs

Oracle Corporation

All CVEs

10,010 total · sorted by risk
  • CVE-2005-0064May 2, 2005
    Xpdf
    Xpdf
    risk 0.01cvss —epss 0.07

    Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.

  • CVE-2004-0638Dec 31, 2004
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.07

    Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1 8.1.7.4, allows remote authorized users to execute arbitrary code via a long…

  • CVE-2003-1208Dec 3, 2004
    Oracle Corporation
    9i
    risk 0.01cvss —epss 0.13

    Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.

  • CVE-2004-0836Nov 3, 2004
    MySQL
    MySQL
    risk 0.01cvss —epss 0.10

    Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length).

  • CVE-2004-0543Aug 6, 2004
    Oracle Corporation
    Applications
    risk 0.01cvss —epss 0.07

    Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.

  • CVE-2004-1371Aug 4, 2004
    Oracle Corporation
    Oracle8i
    risk 0.01cvss —epss 0.11

    Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure.

  • CVE-2004-1365Aug 4, 2004
    Oracle Corporation
    Oracle8i
    risk 0.01cvss —epss 0.07

    Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.

  • CVE-2004-1362Aug 4, 2004
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.09

    The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with…

  • CVE-2004-1366Aug 4, 2004
    Actian
    Database Server
    risk 0.01cvss —epss 0.15

    Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.

  • CVE-2004-1367Aug 4, 2004
    Actian
    Database Server
    risk 0.01cvss —epss 0.07

    Oracle 10g Database Server, when installed with a password that contains an exclamation point ("!") for the (1) DBSNMP or (2) SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.log file, which could allow local users to obtain that…

  • CVE-2004-0385Jun 1, 2004
    Oracle Corporation
    Application Server Web Cache
    risk 0.01cvss —epss 0.15

    Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle…

  • CVE-2003-0634Aug 27, 2003
    Oracle Corporation
    Oracle9i
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the PL/SQL EXTPROC functionality for Oracle9i Database Release 2 and 1, and Oracle 8i, allows authenticated database users, and arbitrary database users in some cases, to execute arbitrary code via a long library name.

  • CVE-2003-0222May 12, 2003
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.11

    Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.

  • CVE-2002-0842Mar 3, 2003
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.15

    Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes…

  • CVE-2003-0095Mar 3, 2003
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.13

    Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login, as exploitable through client applications that perform their own authentication, as…

  • CVE-2003-0096Mar 3, 2003
    Oracle Corporation
    Oracle8i
    risk 0.01cvss —epss 0.16

    Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3)…

  • CVE-2002-1630Dec 31, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.07

    The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.

  • CVE-2002-1631Dec 31, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.08

    SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.

  • CVE-2002-2153Dec 31, 2002
    Orionserver
    Application Server
    risk 0.01cvss —epss 0.07

    Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote attackers to execute arbitrary code.

  • CVE-2002-1376Dec 23, 2002
    MySQL
    MySQL
    risk 0.01cvss —epss 0.07

    libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

  • CVE-2002-1264Nov 12, 2002
    Oracle Corporation
    iSQL*Plus
    risk 0.01cvss —epss 0.08

    Buffer overflow in Oracle iSQL*Plus web application of the Oracle 9 database server allows remote attackers to execute arbitrary code via a long USERID parameter in the isqlplus URL.

  • CVE-2002-0947Oct 4, 2002
    Oracle Corporation
    Reports
    risk 0.01cvss —epss 0.10

    Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long database name parameter.

  • CVE-2002-0857Sep 5, 2002
    Oracle Corporation
    Oracle Listener Control utility
    risk 0.01cvss —epss 0.14

    Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file.

  • CVE-2002-0655Aug 12, 2002
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code.

  • CVE-2002-0567Jul 3, 2002
    Oracle Corporation
    Oracle8i
    risk 0.01cvss —epss 0.09

    Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process.

  • CVE-2002-0561Jul 3, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.10

    The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to gain privileges and modify DAD settings.

  • CVE-2002-0559Jul 3, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.13

    Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP Location header, (2) a long…

  • CVE-2002-0562Jul 3, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.07

    The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.

  • CVE-2002-1641May 27, 2002
    Oracle Corporation
    Application Server Web Cache
    risk 0.01cvss —epss 0.09

    Multiple buffer overflows in Oracle Web Cache for Oracle 9i Application Server (9iAS) allow remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2001-1371Feb 6, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.12

    The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.

  • CVE-2001-1372Feb 6, 2002
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.06

    Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.

  • CVE-2001-1216Dec 21, 2001
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.09

    Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.

  • CVE-2001-0974Jul 17, 2001
    Oracle Corporation
    Internet Directory
    risk 0.01cvss —epss 0.06

    Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

  • CVE-2001-0975Jul 16, 2001
    Oracle Corporation
    Internet Directory
    risk 0.01cvss —epss 0.09

    Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

  • CVE-2001-1454Feb 9, 2001
    MySQL
    MySQL
    risk 0.01cvss —epss 0.10

    Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.

  • CVE-2001-1453Feb 9, 2001
    MySQL
    MySQL
    risk 0.01cvss —epss 0.11

    Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote attackers to execute arbitrary code via a long host parameter.

  • CVE-1999-1547Nov 25, 1999
    Oracle Corporation
    Web Listener
    risk 0.01cvss —epss 0.10

    Oracle Web Listener 2.1 allows remote attackers to bypass access restrictions by replacing a character in the URL with its HTTP-encoded (hex) equivalent.

  • CVE-1999-0385Dec 1, 1998
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.18

    The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.

  • CVE-2026-46979Jun 16, 2026
    Oracle Corporation
    Peoplesoft Enterprise Cs Campus Community
    risk 0.00cvss —epss 0.00

    Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS…

  • CVE-2026-46978Jun 16, 2026
    Oracle Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris.…

  • CVE-2026-46977Jun 16, 2026
    Oracle Corporation
    VM Virtualbox
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox…

  • CVE-2026-46976Jun 16, 2026
    Oracle Corporation
    Oracle Public Sector Payroll
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to…

  • CVE-2026-46974Jun 16, 2026
    Oracle Corporation
    VM Virtualbox
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox…

  • CVE-2026-46973Jun 16, 2026
    Oracle Corporation
    Oracle Outsourced Mfg for Discrete Industries
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access…

  • CVE-2026-46972Jun 16, 2026
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access…

  • CVE-2026-46971Jun 16, 2026
    Oracle Corporation
    HR Intelligence
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise…

  • CVE-2026-46970Jun 16, 2026
    Oracle Corporation
    HR Intelligence
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise…

  • CVE-2026-46969Jun 16, 2026
    Oracle Corporation
    Oracle Financials for EMEA
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to…

  • CVE-2026-46967Jun 16, 2026
    Oracle Corporation
    Public Sector Financials (International)
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via…

  • CVE-2026-46966Jun 16, 2026
    Oracle Corporation
    Universal Work Queue
    risk 0.00cvss —epss 0.00

    Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network…

Page 128 of 201