David Litchfield

The issue is related to errors in the code of the scalar-function implementation in IBM DB2, which can be exploited by a remote attacker to cause a denial of service or execute arbitrary code. The exploitation is possible via unspecified vectors.

Name of the Vulnerable Software and Affected Versions: Oracle Workspace Manager versions prior to 10.2.0.4.1 Oracle Workspace Manager versions prior to 10.1.0.8.0 Oracle Workspace Manager versions prior to 9.2.0.8.0 Description: A SQL injection issue allows attackers to execute arbitrary SQL commands via the `FINDRICSET` procedure in the `LT` package. Recommendations: For versions prior to 10.2.0.4.1, update to version 10.2.0.4.1 or later. For versions prior to 10.1.0.8.0, update to version 10.1.0.8.0 or later. For versions prior to 9.2.0.8.0, update to version 9.2.0.8.0 or later.

The issue concerns an unspecified vulnerability in the Core RDBMS component of Oracle Database. It is reported that this vulnerability may allow local users to inject threads and execute arbitrary code via the `OpenProcess`, `OpenThread`, and `SetThreadContext` functions. This is allegedly due to the RDBMS using a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections.

The issue is related to an unspecified vulnerability in the Core RDBMS component. It has unknown impact and can be exploited through remote authenticated attack vectors.

The issue concerns multiple unspecified vulnerabilities in the Change Data Capture (CDC) component. These vulnerabilities have unknown impact and are related to remote authenticated attack vectors. Specifically, they involve the `sys.dbms cdc ipublish` and `sys.dbms cdc isubscribe` components. Reports suggest that one vulnerability may be related to SQL injection in `CREATE CHANGE TABLE` and `CHANGE TABLE TRIGGER`, while another may be related to PL/SQL injection in the `PREPARE UNBOUNDED VIEW` procedure.

The issue is related to an unspecified vulnerability in the Database Scheduler component, specifically with `sys.dbms scheduler`. It has remote authenticated attack vectors, but the impact is unknown.

The issue affects Oracle E-Business Suite with multiple unspecified vulnerabilities. These vulnerabilities have remote authenticated attack vectors, indicating that an attacker would need to be authenticated to exploit them. The impact of these vulnerabilities is unknown. The vulnerabilities are located in various components, including Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Balanced Scorecard, Oracle Scripting, and Oracle Trading Community.

The issue involves multiple unspecified vulnerabilities with remote authenticated attack vectors. These vulnerabilities are related to the Change Data Capture (CDC) and Oracle Spatial components. Specifically, they involve `sys.dbms cdc impdp`, `sys.dbms cdc isubscribe`, and `mdsys.sdo geor int`. Reports from reliable third parties suggest that these issues may be related to SQL injection in certain functions.

The issue is caused by a buffer overflow when a long `username` is used, leading to an overflow in the `vsprintf` function when displaying the resulting error message, allowing remote attackers to execute arbitrary code.

The issue allows remote authenticated users to create and overwrite arbitrary files. This can be achieved through the `LOTOFILE` and `trl tracefile set` functions, as well as the "SET DEBUG FILE" commands.

The issue allows remote authenticated users to execute arbitrary commands. This can be achieved through the "SET DEBUG FILE" SQL command, as well as the start onpload and dbexp functions.

The issue allows local users to execute arbitrary SQL queries by referencing a malicious package in the `TYPE NAME` argument within the `GET DOMAIN INDEX TABLES` or `GET V2 DOMAIN INDEX TABLES` function in the `DBMS EXPORT EXTENSION` package.

The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue allows attackers to bypass the PLSQLExclusion list, which is supposed to restrict access to certain packages and procedures. This bypass enables attackers to access excluded packages and procedures.

The issue involves multiple unspecified vulnerabilities in the Oracle Database server, affecting components such as Oracle Text and Program Interface Network. It is reported that one of the vulnerabilities, DB17, involves SQL injection in various functions, including `VALIDATE STATEMENT` and `BUILD DML` in `CTXSYS.DRILOAD`, `CLEAN DML` in `CTXSYS.DRIDML`, `GET ROWID` in `CTXSYS.CTX DOC`, `BROWSE WORDS` in `CTXSYS.CTX QUERY`, and `ODCIINDEXTRUNCATE`, `ODCIINDEXDROP`, and `ODCIINDEXDELETE` in `CATINDEXMETHODS`. The impact and attack vectors of these vulnerabilities are unspecified.

The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue affects Oracle PeopleSoft Enterprise Portal with unspecified impact and attack vectors.

The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue concerns an unspecified vulnerability in the Net Foundation Layer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue concerns multiple unspecified vulnerabilities in the Oracle iLearning component, which have unspecified impact and attack vectors.