The package SYS.KUPV$FT contains 3 SQL injection vulnerabilities in the functions ATTACH_JOB, OPEN_JOB, HAS_PRIVS. Oracle fixed these vulnerabilities with the package dbms_assert.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/43323/oracle_sql_injection_kupvft.txt
Source: https://packetstormsecurity.com/files/43323/oracle_sql_injection_kupvft.txt.html