SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple unspecified vulnerabilities.  Some vulnerabilities don't require authentication. It may allow an attacker to craft SQL queries such that they would be able to retrieve any file on the system and potentially retrieve and/or modify confidential data on the target's Oracle server.

According to its version number, the installation of Oracle on the remote
host is reportedly subject to multiple unspecified vulnerabilities.
Some vulnerabilities don't require authentication. It may allow an attacker
to craft SQL queries such that they would be able to retrieve any file on
the system and potentially retrieve and/or modify confidential data on the
target's Oracle server.

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple vulnerabilities, some of which don't require authentication.  They may allow an attacker to craft SQL queries such that they would be able to retrieve any file on the system and potentially retrieve and/or modify confidential data on the target's Oracle server.

ID	Name	Product	Family	Severity
2840	Oracle Database Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium
2822	Oracle Database Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium
18034	Oracle Database 10g Multiple Remote Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2005-4832

high

Tenable Plugins

medium

medium

high