Oracle

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2005-2292 1Oracle 1Jdeveloper Apr 16, 2026 Jul 18, 2005 N/A· v4 N/A· v3 2.1 LOW· v2 Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.
CVE-2005-2291 1Oracle 1Jdeveloper Apr 16, 2026 Jul 18, 2005 N/A· v4 N/A· v3 4.6 MEDIUM· v2 Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to gain sensitive information.
CVE-2005-2093 1Oracle 1Application Server Apr 16, 2026 Jul 5, 2005 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chu...Show more Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."Show less
CVE-2005-1749 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping).
CVE-2005-1748 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a deni...Show more The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.Show less
CVE-2005-1747 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possib...Show more Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.Show less
CVE-2005-1746 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a d...Show more The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.Show less
CVE-2005-1745 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct passwo...Show more The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password.Show less
CVE-2005-1743 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity...Show more BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions.Show less
CVE-2005-1742 2Bea Oracle 2Weblogic Portal Weblogic Server Apr 16, 2026 May 24, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
CVE-2005-1636 2Mysql Oracle 2Mysql Mysql Apr 16, 2026 May 17, 2005 N/A· v4 N/A· v3 4.6 MEDIUM· v2 mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by mo...Show more mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by modifying the file's contents.Show less
CVE-2005-1496 1Oracle 2Application Server Oracle10g Apr 16, 2026 May 11, 2005 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The DBMS_Scheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSION_USER to the SYS user.
CVE-2005-1495 1Oracle 3Application Server Oracle10gOracle9i Apr 16, 2026 May 11, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.
CVE-2005-1383 1Oracle 1Application Server Apr 16, 2026 May 3, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.
CVE-2005-1382 1Oracle 1Application Server Web Cache Apr 16, 2026 May 3, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter.
CVE-2005-1381 1Oracle 1Application Server Web Cache Apr 16, 2026 May 3, 2005 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2) PartialPageErrorPage parameter.
CVE-2005-1197 1Oracle 1Database Server Apr 16, 2026 May 2, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the SYS.DBMS_CDC_IPUBLISH.CREATE_SCN_CHANGE_SET procedure in Oracle Database Server 10g allows remote attackers to execute arbitrary SQL commands via the CHANGE_SET_NAME parameter.
CVE-2005-1178 1Oracle 1Forms Apr 16, 2026 May 2, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in Oracle Forms 10g allows remote attackers to execute arbitrary SQL commands via the Query/Where feature.
CVE-2005-0873 1Oracle 110g Reports Server Apr 16, 2026 May 2, 2005 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in test.jsp in Oracle Reports Server 10g (9.0.4.3.3) allow remote attackers to inject arbitrary web script or HTML via the (1) desname or (2) repprod parameter.
CVE-2005-0711 2Mysql Oracle 2Mysql Mysql Apr 16, 2026 May 2, 2005 N/A· v4 N/A· v3 2.1 LOW· v2 MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink att...Show more MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.Show less

Previous 1...606607608...616 Next