Design/Logic Flaw

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2698

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...

Design/Logic Flaw

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources...

CVE-2007-2694

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the...

CVE-2007-2701

The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected...

CVE-2007-2702

Cross-site scripting XSS vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources...

Design/Logic Flaw

The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2696

The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2704

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service SSL port unavailability by accessing a half-closed SSL socket...

CVE-2007-2704

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service SSL port unavailability by accessing a half-closed SSL socket...

CVE-2007-2701

Technical details about CVE-2007-2701 are not publicly provided in the supplied documents. No concrete affected products, versions, or remediations are confirmed here. Monitor for updates as new information may emerge.

CVE-2007-2704

CVE-2007-2704 affects BEA WebLogic Server 9.0–9.2. A remote attacker can cause a denial of service by connecting to a half‑closed SSL socket, leading to SSL port unavailability. The available sources confirm the vulnerability exists in these WebLogic versions and describe the remote DoS impact vi...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources...

CVE-2007-2702

CVE-2007-2702 describes a cross-site scripting (XSS) vulnerability in the GroupSpace component of BEA WebLogic Portal 9.2 GA. The root cause is an XSS flaw related to the rich text editor, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The conn...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA is affected by CVE-2007-2703. A long role description can corrupt a visitor entitlements role, which might allow remote authenticated users to access privileged resources. The connected records corroborate the same vulnerability description across NVD and related feeds,...