Vulnerability in Oracle Apex
CVE-2007-3854
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
EPSS: 0.025 (83.3th percentile) — read the EPSS interpretation.
Affected products
- Oracle Apex — versions 1.5.0, 1.6.1, 2.0
- Oracle Application_server — versions 1.0.2.2, 9.0.4.3, 10.1.2.0.1
- Oracle Collaboration_suite — versions 10.1.2
- Oracle Database_server — versions 9.0.1.5, 9.2.0.7, 9.2.0.8
- Oracle E-business_suite — versions 11.5.8, 11.5.9, 11.5.10
- Oracle Peoplesoft_enterprise_customer_relationship_management — versions 8.9, 9.0
- Oracle Peoplesoft_enterprise_human_capital_management — versions 8.9, 9.0
- Oracle Peoplesoft_enterprise_peopletools — versions 8.22, 8.47, 8.48
- Oracle Secure_enterprise_search — versions 10.1.6, 10.1.8
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_HP, vendor-advisory)
- cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (US Government Resource, x_refsource_CERT, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vdb-entry, x_refsource_XF)