Oracle ORACLE8I vulnerabilities

46 CVEs affecting Oracle ORACLE8I, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2006-0552, published 2006-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2002-0840, published 2002-10-11. Medium severity, CVSS 6.8. EPSS: 95.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows…
CVE-2001-0499, published 2001-07-21. High severity, CVSS 10.0. EPSS: 85.2% chance of exploitation in the next 30 days. Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3)…
CVE-2002-0568, published 2002-07-03. Low severity, CVSS 2.1. EPSS: 75.2% chance of exploitation in the next 30 days. Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1)…
CVE-2002-0563, published 2002-07-03. Medium severity, CVSS 5.0. EPSS: 51.1% chance of exploitation in the next 30 days. The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0,…
CVE-2002-0843, published 2002-10-11. High severity, CVSS 7.5. EPSS: 21.4% chance of exploitation in the next 30 days. Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly…
CVE-2004-0637, published 2004-09-02. Medium severity, CVSS 6.5. EPSS: 17.8% chance of exploitation in the next 30 days. Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible.
CVE-2003-0096, published 2003-03-03. High severity, CVSS 9.0. EPSS: 15.9% chance of exploitation in the next 30 days. Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the…
CVE-2004-1366, published 2004-08-04. Medium severity, CVSS 4.6. EPSS: 15.5% chance of exploitation in the next 30 days. Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.
CVE-2004-1364, published 2004-08-04. High severity, CVSS 8.5. EPSS: 13.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.
CVE-2002-0857, published 2002-09-05. High severity, CVSS 7.5. EPSS: 13.8% chance of exploitation in the next 30 days. Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing…

Latest

CVE-2006-0552, published 2006-02-04. High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln#…
CVE-2006-0271, published 2006-01-18. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle…
CVE-2006-0262, published 2006-01-18. High severity, CVSS 10.0. EPSS: 3.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as…
CVE-2005-3641, published 2005-11-16. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication by supplying a valid username.
CVE-2004-0638, published 2004-12-31. High severity, CVSS 8.5. EPSS: 6.6% chance of exploitation in the next 30 days. Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1…
CVE-2004-1371, published 2004-08-04. High severity, CVSS 9.0. EPSS: 10.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure.
CVE-2004-1370, published 2004-08-04. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1)…
CVE-2004-1369, published 2004-08-04. Medium severity, CVSS 5.0. EPSS: 5.6% chance of exploitation in the next 30 days. The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used as an invalid offset…
CVE-2004-1368, published 2004-08-04. High severity, CVSS 7.8. EPSS: 5.6% chance of exploitation in the next 30 days. ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.