Oracle's quarterly patch release has coincided with Microsoft's monthly Patch Tuesday security update.
The most critical Oracle patches target vulnerabilities in Oracle Secure Backup and BEA's JRockit Complex Event Processing and WebLogic application server.
Oracle warned that three of 10 database vulnerabilties can be exploited across a network without a user name or password.
Two patches are for Oracle Application Server weaknesses that can also be exploited remotely without authentication.
Other patches fix vulnerabilities in Oracle E-Business Suite components, the PeopleSoft Enterprise, JD Edwards Enterprise One and Siebel application sets, and Oracle Enterprise Manager.
Microsoft issued six security updates to patch nine vulnerabilities, six of which were ranked critical.
Microsoft applications updated include Windows, Publisher, Internet Security and Acceleration Server (ISA) 2006, and Microsoft's client and server virtualisation software.
The patches finally included fixes for vulnerabilities in the Internet Explorer ActiveX control and DirectShow, which attackers have been exploiting for weeks.
Microsoft acknowledged ongoing attacks exploiting a weakness in DirectShow in May and last week that the ActiveX control weakness was discovered 18 months ago.
But Microsoft has failed to release a fix for a problem with Office Web Components, disclosed on Monday, which is being used to attack Windows users.
Dave Marcus, director of McAfee Avert Labs said Windows users continue to be under attack due to an exploit of the vulnerability.
"The attacks involve booby trapped websites that load malicious code onto a vulnerable computer. The compromised PCs are commandeered and join a botnet, a network of hijacked computers," he said.
Many of the vulnerabilities addressed by the fixes could be exploited if a Windows user simply visits a malicious website or opens a rigged Office document, said Marcus.
"Today's Microsoft patches once again underline the risk of using the Internet unprotected," he said. "Criminals today rely on the web and e-mail to deliver malicious software."
This news story first appeared on Computer Weekly