Scope in CVSSv3
Scope is defined in the documentation:
When the vulnerability of a software component governed by one authorization scope is able to affect resources governed by another authorization scope, a Scope change has occurred.
Examples
1) SQL Injection: Changed.
Vulnerable component: Webserver/database server
Impacted component: Web application. Can cause webapp to be non-available.
I would disagree with your reasoning, but would agree that the scope is changed.
The vulnerable component is the web application: The vulnerability wasn't introduced by the server, nor by the DBMS, but the issue exists because the web application inserted user input into an SQL query.
The affected component is the database, as it governs the data it holds, and an attack can extract information from it that shouldn't be available. If system commands can be executed or if files can be uploaded, the server would also be affected.
Other opinions:
It can be seen that there is at least some unclarity about rating the scope of SQL injections. I haven't found any other examples that determine the scope of an SQL injection.
2) XSS: Changed
Vulnerable component: webserver
Impacted component: browser
Makes sense, and this is also how First rates it in their XSS example.
3) Unvalidated Redirects: Changed.
Vulnerable component: webserver
Impacted component: browser (malware can be downloaded)
This also makes sense, for the same reason as XSS.
4) CSRF: Unchanged
This also makes sense, and is also how First rates it in their CSRF example. The vulnerable and the impacted component are both the web application.
5) Session Fixation: Unchanged
This also makes sense, for the same reason as CSRF.
6) Insecure Direct Object Reference: Unchanged
This also makes sense, for the same reason as CSRF.
7) Unrestricted File Upload: Changed
Vulnerable Component: web server
Impacted Component : could be host OS
This makes sense.