Emad Al-Mousa

اسم البرنامج المعرض للثغرة والإصدارات المتأثرة: SQL Server (الإصدارات المتأثرة غير محددة) الوصف: تسمح ضوابط الوصول غير الملائمة في SQL Server لمهاجم مخول برفع مستوى امتيازاته عبر الشبكة. التوصيات: لا توجد في الوقت الحالي أي معلومات حول إصدار أحدث يتضمن تصحيحًا لهذه الثغرة الأمنية.

توجد هذه المشكلة في مكون Unified Audit في Oracle Database Server. يمكن للمهاجم الذي يتمتع بامتيازات عالية، ولديه امتياز Create User ووصول إلى الشبكة عبر Oracle Net، اختراق مكون Unified Audit. يتطلب الاستغلال الناجح تفاعل مستخدم آخر غير المهاجم، وقد يؤدي إلى تعديل أو إدراج أو حذف غير مصرح به للبيانات في مكون Unified Audit.

تؤثر هذه المشكلة على مكون «الرؤية المادية» (Materialized View) في قاعدة بيانات Oracle. يمكن لمهاجم يتمتع بامتيازات عالية، ولديه امتياز «Execute on DBMS REDEFINITION» ووصول شبكي عبر Oracle Net، أن يخترق «الرؤية المادية» في قاعدة بيانات Oracle. وقد يؤدي الاستغلال الناجح لهذه الثغرة إلى تعديل أو إدراج أو حذف غير مصرح به للبيانات داخل «الرؤى المادية» التي يمكن الوصول إليها.

The issue is related to insufficient input validation in the Unified Audit component of Oracle Database Server. This can allow a remote attacker with high privileges, specifically those with SYSDBA privilege and network access via Oracle Net, to compromise the Unified Audit component. Successful exploitation can result in unauthorized access to critical data, including creation, deletion, or modification of data within the Unified Audit accessible data.

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.22 Oracle Database Server versions 21.3 through 21.13 Description: The issue is related to insufficient input validation in the Oracle Database Sharding component. It allows a high-privileged attacker with DBA privilege and network access via Oracle Net to compromise Oracle Database Sharding. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized ability to cause a partial denial of service of Oracle Database Sharding. Recommendations: For versions 19.3 through 19.22, update to a version that includes the fix for this issue. For versions 21.3 through 21.13, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Oracle Database Sharding component to minimize the risk of exploitation.

The issue is related to improper authorization in the Database Core Component of Oracle Database Server. This can allow a remote attacker to gain unauthorized access to read, modify, or delete data. Successful attacks can result in unauthorized update, insert, or delete access to some of the Oracle Database Core accessible data.

The issue is related to insufficient input validation in the Web Access component of the Primavera P6 Enterprise Project Portfolio Management product. This can allow a remote attacker to gain unauthorized access to protected information and modify, add, or delete data. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data.

The issue is related to insufficient input validation in the Oracle Database Recovery Manager component. This allows a high-privileged attacker with DBA account privilege and network access via Oracle Net to compromise the Oracle Database Recovery Manager. Successful attacks can result in the ability to cause a hang or frequently repeatable crash (complete DOS) of the Oracle Database Recovery Manager.

The issue is related to insufficient input validation in the Oracle Database Sharding component. It allows a high-privileged attacker with network access via Oracle Net to compromise Oracle Database Sharding, resulting in a partial denial of service (partial DOS). Successful attacks require human interaction from a person other than the attacker.

The issue is related to insufficient input validation in the Database Sharding component of Oracle Database Server. This can be exploited by a remote attacker to cause a partial denial of service. The attack requires human interaction from a person other than the attacker and can be carried out by a high-privileged attacker with Create Session and Select Any Dictionary privileges via Oracle Net. Successful exploitation can result in unauthorized ability to cause a partial denial of service of Oracle Database Sharding.

The issue is related to insufficient input validation in the Unified Audit component of Oracle Database Server. It allows a high-privileged attacker with SYSDBA privilege and network access via Oracle Net to compromise Unified Audit. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Unified Audit accessible data.

The issue is related to insufficient input validation in the Installation component of Oracle SQL Developer, allowing a high-privileged attacker with logon to the infrastructure where Oracle SQL Developer executes to compromise Oracle SQL Developer. Successful attacks can result in the takeover of Oracle SQL Developer.

The issue exists due to insufficient input validation in the Oracle Database Recovery Manager component of Oracle Database Server. This can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash of Oracle Database Recovery Manager, which may significantly impact additional products.

The issue is related to insufficient input validation in the E1 IOT Orchestrator component. It allows a low-privileged attacker with network access via HTTP to compromise the JD Edwards EnterpriseOne Orchestrator, resulting in unauthorized read access to a subset of accessible data.

The issue is related to errors in resource release in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server. Exploitation of this issue can allow a remote attacker to cause a denial of service using the Oracle Net protocol. A highly privileged attacker with DBA role privilege and network access via Oracle Net can compromise Oracle Database - Enterprise Edition RDBMS Security, resulting in the ability to cause a partial denial of service.

The issue is related to insufficient input validation in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. This easily exploitable vulnerability allows a high-privileged attacker with Create Any Procedure privilege and network access via Oracle Net to compromise Oracle Database - Enterprise Edition Sharding, potentially resulting in a takeover.

Name of the Vulnerable Software and Affected Versions: Oracle Database Enterprise Edition Unified Audit versions 12.1.0.2, 12.2.0.1 and 19c Description: The issue affects the Oracle Database Enterprise Edition Unified Audit component of Oracle Database Server, allowing a high-privileged attacker with local logon privilege and network access via Oracle Net to compromise the component. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data. Recommendations: For versions 12.1.0.2, 12.2.0.1, and 19c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient input validation in the Database Vault component of Oracle Database Server. This allows a high-privileged attacker with DBA privilege and network access via Oracle Net to compromise Database Vault, resulting in unauthorized read access to a subset of Database Vault accessible data. The vulnerability can be exploited remotely using the HTTP protocol.

The issue is related to inadequate access control in the Oracle Database - Enterprise Edition component of Oracle Database Server. It allows a high-privileged attacker with RMAN executable privilege and logon access to the infrastructure to compromise Oracle Database - Enterprise Edition. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle Database - Enterprise Edition's accessible data.

The issue is related to the Database Vault component, where an easily exploitable vulnerability allows a high-privileged attacker with Create Any View, Select Any View privilege and network access via Oracle Net to compromise Database Vault. This can result in unauthorized read access to a subset of Database Vault accessible data.