Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view.

Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11.

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMSREGISTRY package in certain parameters to the (1) ISCOMPONENT, (2) GETCOMPOPTION, (3) DISABLEDDLTRIGGERS, (4) SCRIPTEXISTS, (5) COMPPATH, (6) GATHERSTATS, (7) NOTHINGSCRIPT, and (8) VALIDATECOMPONENTS functions.

Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMSXMLSCHEMA and (b) DBMSXMLSCHEMAINT packages, as exploitable via long arguments to (1) XDB.DBMSXMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMSXMLSCHEMA.GENERATESCHEMAS.