Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2006-0586

7.5 · HIGH
Published Feb 8, 2006 oracle CWE-89 EPSS 6.51% (93th pctl)

Overview

CVE-2006-0586 is a high-severity vulnerability affecting oracle application_server. It was published on February 8, 2006 and has a CVSS 2.0 base score of 7.5 (HIGH).

This vulnerability has a CVSS 2.0 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues.

Remediation

Check the references section for vendor advisories and patches from oracle. Update application_server to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status

References

Ref lists.grok.org.uk/pipermail/full-disclosure/2006-January/041498.html Ref lists.grok.org.uk/pipermail/full-disclosure/2006-January/041499.html Ref www.osvdb.org/22839 Ref www.osvdb.org/22840 Ref www.red-database-security.com/advisory/oracle_cpu_jan_2006.html Ref www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft.html Ref www.red-database-security.com/advisory/oracle_sql_injection_kupv%24ft_int.html Ref www.securityfocus.com/archive/1/422423/30/7370/threaded Ref www.securityfocus.com/archive/1/422424/30/7370/threaded Ref www.securityfocus.com/bid/16294

Frequently Asked Questions

What is CVE-2006-0586?

CVE-2006-0586 is a high-severity vulnerability affecting oracle application_server. It was published on February 8, 2006 and has a CVSS 2.0 base score of 7.5 (HIGH).

How severe is CVE-2006-0586?

This vulnerability has a CVSS 2.0 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2006-0586?

Check the references section for vendor advisories and patches from oracle. Update application_server to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2006-0586?

CyberStrike's AI-powered security agents can automatically detect CVE-2006-0586 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related HIGH CVEs from 2006

View all →
10.0
CVE-2006-0119

Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown

10.0
CVE-2006-0128

Buffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to

10.0
CVE-2006-0218

Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact

10.0
CVE-2006-0256

Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1

10.0
CVE-2006-0257

Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10

10.0
CVE-2006-0258

Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and

10.0
CVE-2006-0259

Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and

10.0
CVE-2006-0260

Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified

10.0
CVE-2006-0261

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0

10.0
CVE-2006-0262

Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9

10.0
CVE-2006-0263

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0

10.0
CVE-2006-0265

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5,

Browse by year 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2000 1999