CVE-2005-1744

BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role...

CVE-2005-1747

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the 1 jusername or 2 jpassword parameter...

CVE-2005-1748

The CVE-2005-1748 issue affects BEA WebLogic Server and WebLogic Express, specifically the embedded LDAP server in versions 8.1 through Service Pack 4 and 7.0 through Service Pack 5. The root cause is the LDAP server allowing remote anonymous binds, which may enable remote attackers to view user ...

CVE-2005-1746

CVE-2005-1746 affects BEA WebLogic Server 7.0 up to Service Pack 5. The cluster cookie parsing code may contact any host/port specified in a cookie, even if not in the cluster, allowing remote attackers to cause a denial of service (cluster slowdown) via modified cookies. The provided sources do ...

CVE-2005-1749

Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service CPU consumption from thread looping...

CVE-2005-1745

The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password...

CVE-2005-1743

BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions...

CVE-2005-1742

CVE-2005-1742 affects BEA WebLogic Server and WebLogic Express 8.1 SP2/SP3. The vulnerability allows users with the Monitor security role to shrink or reset JDBC connection pools, indicating an authorization/privilege misuse issue affecting pool configuration. The provided documents confirm the a...

CVE-2005-1747

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the 1 jusername or 2 jpassword parameter...

BEA WebLogic <= 8.1 SP4 Multiple Vulnerabilities (XSS, DoS, ID, more)

According to its banner, the remote host is running a version of BEA WebLogic Server or WebLogic Express that is prone to multiple vulnerabilities. These flaws could lead to buffer overflows, denial of service, unauthorized access, cross-site scripting attacks, and information disclosure. C Tenab...

CVE-2001-1477

BEA Tuxedo 7.1 Domain gateway is vulnerable: it does not perform authorization checks for imported services and qspaces on remote domains, even when an ACL exists, allowing access to remote-domain services. The issue is described across multiple records (NVD/CVE and CVE listing). No remediation d...

CVE-2001-1477

The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote domains, even when an ACL exists, which allows users to access services in a remote domain...

CVE-2005-1380

Cross-site scripting XSS vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action...

CVE-2005-1380

Cross-site scripting XSS vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action...

CVE-2005-1380

BeA Admin Console 8.1 is affected by a cross-site scripting (XSS) vulnerability in the JndiFramesetAction path, allowing remote attackers to inject script via the server parameter. The issue is documented across multiple sources (CVE-2005-1380) with a CVSS v2 base score of 6.8 (MEDIUM) and networ...

CVE-2005-0432

BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks...

Cross Site Scripting in BEA Admin console

Name Cross Site Scripting in BEA Admin Console Systems Affected BEA Admin Console 8.1 Severity Low Risk Category CSS/XSS Vendor URL http://www.bea.com Author Alexander Kornbrust ak at red-database-security.com Date 25 Apr 2005 V 1.00 Advisory AKSEC2004-042 Details One input field in the BEA Admin...

BEA application server Admin console crossite scripting

Crossite scripting with http://server:8001/console/actions/jndi/JndiFramesetAction/...

BEA WebLogic Server 8.1 WebLogic Express Administration Console - Cross-Site Scripting

BEA WebLogic Server 8.1 WebLogic Express Administration Console - Cross-Site Scripting source: https://www.securityfocus.com/bid/13400/info A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebLogic Express administration console. This issue is due to a failure of the...

CVE-2004-1757

CVE-2004-1757 affects BEA WebLogic Server and WebLogic Express 8.1, SP1 and earlier. The issue is that the administrator password is stored in cleartext in config.xml, allowing local users to gain privileges. The vulnerability is rooted in improper password storage on the affected server, with lo...