Oracle Database Server vulnerabilities

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.

Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to compromise RDBMS.

Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker having Create DB Link privilege with network access via Oracle Net to compromise RDBMS.

Vulnerability in the Oracle Text component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Create Index privilege and network access via Oracle Net can compromise Oracle Text. The vulnerability is difficult to exploit but may impact additional products (scope change).

Vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access via Oracle Net can compromise RDBMS. The vulnerability is easily exploitable.

Vulnerability in the RDBMS component of Oracle Database Server in versions 23.4.0-23.26.3. Easily exploitable, allows attacker with Create Table privilege via Oracle Net to take over RDBMS.

Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with XDKC privilege and network access via Oracle Net can take over Oracle XML Developers Kit.

Vulnerability in the RDBMS component of Oracle Database Server. Affected versions are 23.4.0-23.26.3. Easily exploitable issue allows an attacker with Authenticated User privilege via Oracle Net to cause complete denial of service (hang or frequent crashes) in RDBMS, and attacks may impact additional products.

Vulnerability in the RDBMS component of Oracle Database Server, affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable by unauthenticated attacker over network (Oracle Net). Successful attack can allow unauthorized read access to a subset of data.

Vulnerability in the RDBMS component of Oracle Database Server affects versions 23.4.0-23.26.3. A low-privileged attacker (Authenticated User) via Oracle Net, under difficult conditions, can take over the system and impact other products.

Vulnerability in the RDBMS component of Oracle Database Server allows a low-privileged attacker (Authenticated User) with network access via Oracle Net to compromise the database. No user interaction is required.

Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.

Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).

Vulnerability in the RDBMS component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can cause a complete denial of service (DoS) and unauthorized modification, insertion, or deletion of some data.

Vulnerability in the JDBC component of Oracle Database Server in versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable flaw requires human interaction and allows a high-privileged attacker with network access via Oracle Net to take over the JDBC component.

Vulnerability in the Java VM component of Oracle Database Server allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to unauthorized create, delete, or modify critical data. The attack is easy to exploit.

Vulnerability in RDBMS component of Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable by high-privileged attacker with network access via Oracle Net. Successful attack may lead to unauthorized data modification.

Vulnerability in the RDBMS component of Oracle Database Server. Affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. An unauthenticated attacker with network access via Oracle Net can exploit it without user interaction. Successful attack allows unauthorized update, insert, or delete access to some RDBMS data, with potential impact on additional products (scope change).

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequent crash (complete DoS) of the service.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequently repeatable crash (complete DOS) of Net Service.

Vulnerability in the XML Database component of Oracle Database Server allows an unauthenticated attacker remote access via HTTPS to confidential data. It requires user interaction and is difficult to exploit.

Vulnerability in the Java VM component of Oracle Database Server (versions 19.3-19.28, 21.3-21.19, 23.4-23.9). Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Java VM. Successful attacks can result in unauthorized creation, deletion or modification of critical data or all Java VM accessible data. CVSS 5.9 (Integrity impact).

Vulnerability in the Unified Audit component of Oracle Database Server (versions 23.4-23.9). An attacker with DBA privilege and network access via Oracle Net can compromise Unified Audit, potentially leading to unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 2.7.

Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Affected versions are 23.4-23.9. A high privileged attacker with SYSDBA privilege and network access via Oracle Net can compromise RDBMS Functional Index, resulting in unauthorized read access to a subset of data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).

A vulnerability in the Portable Clusterware component of Oracle Database Server allows an unauthenticated attacker with network access via Bonjour to compromise Portable Clusterware. Successful attacks can result in unauthorized read access to a subset of data. Affects versions 19.3-19.28, 21.3-21.19, 23.4-23.9.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Affected versions are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction and may significantly impact additional products. Successful attacks can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces Native Network Encryption changes to address this vulnerability. CVSS 3.1 Base Score 8.3.