Unscored severity · published Jan 18, 2006
CVE-2006-0257
Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Database Server · Oracle
9.2.0.7; 10.1.0.5; 10.2.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0257
Vendor Advisory
http://secunia.com/advisories/18493
Vendor Advisory
http://secunia.com/advisories/18608
Patch
http://securitytracker.com/id?1015499
Third Party Advisory
http://www.kb.cert.org/vuls/id/545804
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
www.osvdb.org
http://www.osvdb.org/22540
More from Database Server
10.0
CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements
9.9
CVE-2026-61211
Vulnerability in the RDBMS component of Oracle Database Server
9.9
CVE-2018-3110
A vulnerability was discovered in the Java VM component of Oracle Database Server
9.8
CVE-2019-16942
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10
9.8
CVE-2018-14719
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…