The package SYS.DBMS_CDC_IMPDP contains SQL injection vulnerabilities. Oracle fixed this by using dbms_assert.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/51385/Oracle-SYS.DBMS_CDC_IMPDP.txt
Source: https://packetstormsecurity.com/files/51385/Oracle-SYS.DBMS_CDC_IMPDP.txt.html