NGSSoftware has discovered SQL injection and buffer overflow vulnerabilities in Oracle 10g and 9i database servers.