I was eyeing that schedulerURL - I can't think of a situation (for our implementation at least) where schedulerURL doesn't equal the application URL... but I've traveled this far, so...
SELECT
P.NAME
, CAST(REPLACE(REPLACE(CAST(P.VALUE AS NVARCHAR(MAX)),'utf-8','utf-16'), '&', '&') AS XML).query('data(/properties/webServer/webServerInstance[@id="app"]/@sslEntryUrl)') as 'CA PPM URL'
FROM CMN_CONFIG P
WHERE P.NAME = 'properties.xml'

Things I have learned this morning (we're MSSQL Server, Oracle will certainly be different):
1) The Value column's data type is ntext. This needs to be converted to an XML data type.
2) The properties file is UTF-8. This needs converted to UTF-16 and on MSSQL you need to convert the ntext to nvarchar first.
3) Ampersands sting.
Surely there has to be an easier way than this - but we're done here. I'm chewing on the Idea for making this easier. So far I think the easiest approach would be to add another column to CMN_CONFIG with a Data Type in MSSQL of 'XML' and 'XMLType' in Oracle and keep a copy of the properties.xml there as well, that way we can simply xPath our way into this data without having to jump through character and data type hoops.