Description

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMS_STATS.GATHER_TABLE_STATS.

Remediation

References

CVE-2012-3132

Related Vulnerabilities

MySQL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2018-0735)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-1133)

Internet Information Services Other Vulnerability (CVE-2002-0150)

Apache HTTP Server Other Vulnerability (CVE-2002-2029)

Oracle Application Server CVE-2006-0273 Vulnerability (CVE-2006-0273)

Severity

Medium

Classification

CVE-2012-3132 CWE-138

Tags

Missing Update Known Vulnerabilities