Design/Logic Flaw

BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426...

Code injection

SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a differen...

CVE-2007-4613

SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a differen...

CVE-2007-4614

CVE-2007-4614 describes BEA WebLogic-related vulnerability where an admin server security policy change log is not properly propagated to temporarily unavailable managed servers, potentially allowing attackers to bypass applied restrictions. The connected records indicate a related entry (CVE-200...

CVE-2007-4613

CVE-2007-4613 affects BEA WebLogic Server SSL libraries (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP5). Vulnerability: an attacker in a MITM can obtain plaintext from an SSL stream by injecting crafted data and measuring timing of error responses. This is a separate issue from CVE-2006-2461....

CVE-2007-4617

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service server thread hang via unspecified vectors...

CVE-2007-4613

SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a differen...

CVE-2007-4618

CVE-2007-4618 affects BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7. The issue is an unspecified vulnerability that allows remote attackers to cause a denial of service via certain malformed HTTP headers, leading to disk consumption. The provided documents do not include expli...

CVE-2007-4618

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service disk consumption via certain malformed HTTP headers...

CVE-2007-4616

The CVE-2007-4616 entry concerns the SSL server implementation in BEA WebLogic Server (versions ranging from 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0). The issue is that the server may select the null cipher when no other cipher is compatible with the c...

CVE-2007-4617

CVE-2007-4617 affects BEA WebLogic Server (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP4). The vulnerability description cites an unspecified issue that allows remote attackers to cause a denial-of-service via unspecified vectors. The connected documents do not provide concrete exploitation d...

CVE-2007-4615

The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications...

CVE-2007-4616

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept...

CVE-2007-4615

The CVE-2007-4615 entry concerns BEA WebLogic Server’s SSL client implementation. Affected versions include BEA WebLogic Server 7.0 SP7, 8.1 SP2–SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0. The vulnerability arises when the SSL client sometimes selects the null cipher if other ciphers are avail...

BEA WebLogic应用程序存在多个安全漏洞

BEA WebLogic Server是功能强大的WEB应用服务程序。 BEA WebLogic Server存在多个安全问题，远程攻击者可以利用漏洞进行跨站脚本，HTML注入，信息泄露，目录遍历，安全绕过，暴力攻击和拒绝服务等攻击。 目前没有详细漏洞细节提供。 BEA Systems WebLogic Workshop 8.1 SP 6 BEA Systems WebLogic Workshop 8.1 SP 5 BEA Systems WebLogic Workshop 8.1 SP 4 BEA Systems WebLogic Workshop 8.1 SP 3 BEA Syste...

Hardcoded credentials

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access...

Design/Logic Flaw

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service SSL port unavailability by accessing a half-closed SSL socket...

Information disclosure

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...

Information disclosure

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

Design/Logic Flaw

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...