Esteban Martinez Fayo

The issue allows remote attackers to obtain the session key and salt for arbitrary users. This leaks information about the cryptographic hash, making it easier to conduct brute force password guessing attacks.

The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue involves multiple unspecified vulnerabilities in various components of the Oracle Database server, including the Data Pump, Oracle Text, Streams Apply, Streams Capture, and Streams Subcomponent. One of the vulnerabilities, DB05, is claimed by a reliable independent researcher to involve SQL injection in several functions within the DBMS METADATA UTIL, DBMS METADATA INT, and DBMS METADATA packages. These functions include `LONG2VARCHAR`, `LONG2VCMAX`, `LONG2VCNT`, `LONG2CLOB`, `MAKE FILTER`, `FETCH VIEWS ERROR`, `FETCH FILTERS`, `FETCH VIEWS`, `SET FILTER COMMON`, `DO FILTER SCRIPT`, `SET TABLE FILTERS`, `MAKE FILTER TEXT`, and `GET PREPOST TABLE ACT`.

The issue involves multiple unspecified vulnerabilities in the Oracle Database server, affecting components such as Oracle Text and Program Interface Network. It is reported that one of the vulnerabilities, DB17, involves SQL injection in various functions, including `VALIDATE STATEMENT` and `BUILD DML` in `CTXSYS.DRILOAD`, `CLEAN DML` in `CTXSYS.DRIDML`, `GET ROWID` in `CTXSYS.CTX DOC`, `BROWSE WORDS` in `CTXSYS.CTX QUERY`, and `ODCIINDEXTRUNCATE`, `ODCIINDEXDROP`, and `ODCIINDEXDELETE` in `CATINDEXMETHODS`. The impact and attack vectors of these vulnerabilities are unspecified.

The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue is related to an unspecified vulnerability in the Streams Capture component, potentially allowing SQL injection in the SET DIRECTORY ROOT function within the DBMS CDC PUBLISH package. Details about the vulnerability are limited due to unavailability from Oracle.

The issue is related to an unspecified vulnerability in the Upgrade & Downgrade component, potentially allowing SQL injection in the DBMS REGISTRY package. This affects certain parameters to the following functions: (1) IS COMPONENT, (2) GET COMP OPTION, (3) DISABLE DDL TRIGGERS, (4) SCRIPT EXISTS, (5) COMP PATH, (6) GATHER STATS, (7) NOTHING SCRIPT, and (8) VALIDATE COMPONENTS. The estimated number of potentially affected devices and details about real-world incidents are not available.

The issue concerns an unspecified vulnerability in the Portal component of Oracle Application Server. Details about the impact and attack vectors of this issue are not specified.

The issue allows remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data. The Connection Manager component is affected, but specific details about the impact and attack vectors are not provided.

The issue affects multiple components of Oracle Collaboration Suite, including the Email Server, Oracle Collaboration Suite Wireless & Voice, Oracle Content Management SDK, and Oracle Content Services. The vulnerabilities have unspecified impact and attack vectors.

The issue affects various components of Oracle E-Business Suite and Applications, including the Application Install, Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Human Resources, Oracle Marketing, Marketing Encyclopedia System, Oracle Trade Management, and Oracle Web Applications Desktop Integration components. The vulnerabilities have unspecified impact and attack vectors.

The issue affects Oracle E-Business Suite and Applications, with unspecified vulnerabilities identified in several components, including the CRM Technical Foundation, iProcurement, and Oracle Application Object Library. These vulnerabilities have unspecified impact and attack vectors.

The issue concerns multiple unspecified vulnerabilities in the Oracle iLearning component, which have unspecified impact and attack vectors.

The issue affects Oracle PeopleSoft Enterprise Portal with unspecified impact and attack vectors.

The issue affects the Reorganize Objects & Convert Tablespace component and has an unspecified impact and attack vectors.

The issue concerns multiple unspecified vulnerabilities in various Oracle products, including Database Server, Application Server, Collaboration Suite, and E-Business Suite. These vulnerabilities are identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component. The impact and attack vectors of these vulnerabilities are not specified.

The issue concerns an unspecified vulnerability in the Oracle Reports Developer component. Details about the impact and attack vectors of this issue are not provided.

The issue affects the Oracle Database server and involves multiple unspecified vulnerabilities in various components, including the Data Pump, Net Listener, and Oracle Text components. Specifically, it is claimed by a reliable independent researcher that one of the vulnerabilities, DB06, is a SQL injection issue in certain functions within the DBMS DATAPUMP module, including `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`. The exact impact and attack vectors are not specified due to unavailable details from Oracle.