CVE-2009-1991

LowCVSS 3.6/10Last modified Jun 16, 2026

Description

Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an established researcher that this is for multiple SQL injection vulnerabilities via the (1) idx_owner or (2) idx_name parameters to the create_tables procedure.

Metrics

CVSS 2.0 3.6/10AV:N/AC:H/Au:S/C:P/I:P/A:N

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-199210.0Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect c CVE-2009-19935.5Unspecified vulnerability in the Application Express component in Oracle Database 3.0.1 allows remote authenticated users to affect confiden CVE-2009-19946.5Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidenti CVE-2009-19954.9Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to af CVE-2009-19964.0Unspecified vulnerability in the Logical Standby component in Oracle Database allows remote authenticated users to affect integrity via unkn CVE-2009-19975.0Unspecified vulnerability in the Authentication component in Oracle Database 10.2.0.3 and 11.1.0.7 allows remote attackers to affect confide CVE-2009-19984.9Unspecified vulnerability in the Oracle Communications Order and Service Management component in Oracle Industry Applications 2.8.0, 6.2.0, CVE-2009-19994.3Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows CVE-2009-20005.0Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.7 allows remote attackers to affect confidentiality via CVE-2009-200018.1An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout CVE-2009-200028.4Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The a CVE-2009-200038.4Xenorate versions up to and including 2.50, a Windows-based multimedia player, is vulnerable to a stack-based buffer overflow when processin