CVE-2019-2888

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: EJB Container. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2019-36445)

Oracle WebLogic Server is a Java EE application server. An unspecified vulnerability exists in the EJB Container component in Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0. An attacker could exploit this vulnerability to affect confidentiality...

Oracle WebLogic Server Multiple Remote Security Vulnerabilities

Description Oracle WebLogic Server is prone to multiple remote security vulnerabilities. These vulnerabilities can be exploited over the 'HTTP' protocol. The 'Console', 'Web Services', 'EJB Container', and 'Web Services' components are affected. These vulnerabilities affect the following supporte...

CVE-2018-16386

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...

Weak Authentication

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A flaw was discovered in the way authenticated connections were cached on the server by remote-naming. After a user has successfully logged in, a remote attacker could use a...

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

Cross Site Scripting (XSS)

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: EJB Container. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2019-2646

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: EJB Container. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2019-2646

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: EJB Container. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2019-2646

CVE-2019-2646 affects Oracle WebLogic Server (EJB Container). Affected versions are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. The issue allows an unauthenticated, network-accessible attacker via T3 to compromise and takeover the WebLogic Server, exposing confidentiality, integrity and availability. ...

Oracle WebLogic Server Multiple Vulnerabilities (Apr 2019 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework allows a low privileged, remote attacker with network access via HTTP to compromise and takeover the Oracle Communications Unified...

Oracle WebLogic Server high-risk security vulnerability alerts-a vulnerability alert-the black bar safety net

2019 04 May 17, 360CERT detection to the Oracle in 4 December 17 release of the security Bulletin. The security Bulletin disclosed the WebLogic Server there are multiple high-risk vulnerabilities that affect multiple WebLogic components. 360CERT it is determined that the security updates for...

Oracle WebLogic Server Component Access Control Error Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

Session Hijacking

jboss-remote-naming is vulnerable to session hijacking attacks. The vulnerability exists as Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

Apache Camel: source code security analysis report

Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Camel' software: Using Synchronization Primitives in EJB components Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources Violating the Java Object Model Using...

CVE-2012-4550

JBoss Enterprise Application Platform aka JBoss EAP or JBEAP before 6.0.1, when using role-based authorization for Enterprise Java Beans EJB access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to...

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

CVE-2015-1882

CVE-2015-1882 affects IBM WebSphere Application Server Liberty Profile (8.5.x) prior to 8.5.5.5. It describes multiple race conditions that let remote authenticated users gain elevated privileges by exploiting thread conflicts that execute Java code outside the configured EJB Run-as context. The ...

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...