Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script or HTML, and subsequently execute SQL statements via the (1) p or (2) p_t02 parameters.

The remote Oracle database server is missing the October 2005 Critical Patch Update (CPU) and therefore is potentially affected by security issues in the following components :

  - Change Data Capture

  - Data Guard Logical Standby

  - Data Pump Export

  - Database Scheduler

  - Export

  - Locale

  - Materialized Views

  - Objects Extension

  - Oracle HTTP Server

  - Oracle Intelligent Agent

  - Oracle Internet Directory

  - Oracle Label Security

  - Oracle Security Service

  - Oracle Single Sign-On

  - Oracle Spatial

  - Oracle Workflow Cartridge

  - PL/SQL

  - Programmatic Interface

  - Security

  - Workspace Manager

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple unspecified vulnerabilities.  Some vulnerabilities don't require authentication. It may allow an attacker to craft SQL queries such that they would be able to retrieve any file on the system and potentially retrieve and/or modify confidential data on the target's Oracle server.

According to its version number, the installation of Oracle on the remote
host is reportedly subject to multiple unspecified vulnerabilities.
Some vulnerabilities don't require authentication. It may allow an attacker
to craft SQL queries such that they would be able to retrieve any file on
the system and potentially retrieve and/or modify confidential data on the
target's Oracle server.

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple vulnerabilities, some of which don't require authentication.  They may allow an attacker to craft SQL queries such that they would be able to retrieve any file on the system and potentially retrieve and/or modify confidential data on the target's Oracle server.

ID	Name	Product	Family	Severity
56050	Oracle Database Multiple Vulnerabilities (October 2005 CPU)	Nessus	Databases	medium
2840	Oracle Database Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium
2822	Oracle Database Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium
18034	Oracle Database 10g Multiple Remote Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2005-3202

medium

Tenable Plugins

medium

medium

medium

high