Oracle BEA WebLogic Server Apache Connector Buffer Overflow (CVE-2008-4008)

Oracle BEA WebLogic Server is an enterprise-class multi-tier Java Application Server platform. WebLogic is typically used as the platform for large enterprise web applications. It supports various databases including Oracle, DB2, Microsoft SQL Server, MySQL and other JDBC-compliant databases. The...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Oracle WebLogic Server管理控制台HTML注入漏洞

BUGTRAQ ID: 36766 CVECAN ID: CVE-2009-3396 WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 WebLogic Server的管理控制台存在HTML注入漏洞，远程攻击者可以通过提交恶意的URL请求获得WebLogic管理员的会话Cookie，之后利用这个Cookie获得对控制台的管理访问。 即使在通过HTTPS访问管理控制台和启用了管理端口的情况下也可以利用这个漏洞。 Oracle WebLogic Server 10.3 临时解决方法： 禁用WebLogic管理控制台。 厂商补丁： Orac...

HTML Injection in Oracle WebLogic Server Console (ASPR #2009-10-30-1)

No description provided by source. =====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2009-10-30-1 ------------------------------------------------------------------------- ASPR 2009-10-30-1: HTML Injection i...

ACROS Security: HTML Injection in Oracle WebLogic Server Console (ASPR #2009-10-30-1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2009-10-30-1 ------------------------------------------------------------------------- ASPR 2009-10-30-1: HTML Injection in Oracle WebLogic Server Console...

Design/Logic Flaw

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to affect integrity, related to WLS Console...

Design/Logic Flaw

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity, related to WLS Console...

CVE-2009-3396

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to affect integrity, related to WLS Console...

CVE-2009-3399

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity, related to WLS Console...

CVE-2009-3396

CVE-2009-3396 affects Oracle/BEA WebLogic Server (WebLogic Server 10.3 with BEA Product Suite). The connected data confirms an HTML injection vulnerability in the WebLogic Server Console (WLS Console) that allows remote attackers to obtain the WebLogic admin session cookie via specially crafted H...

CVE-2009-3399

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity, related to WLS Console...

CVE-2009-3396

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to affect integrity, related to WLS Console...

CVE-2009-3399

The CVE-2009-3399 entry affects BEA WebLogic Server (WebLogic Server component) in BEA Product Suite versions 7.0.6 and 8.1.5. The vulnerability is associated with the WLS Console and is exploitable over HTTP/Network with no authentication required, enabling remote attackers to impact integrity. ...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Oracle BEA WebLogic Server console-help.portal Cross-Site Scripting (CVE-2009-1975)

BEA WebLogic Server is an enterprise-class Java Application Server platform. WebLogic is typically used as the platform for large enterprise web applications. A cross-site scripting vulnerability was reported in BEA Weblogic Server. The vulnerability is due to lack of sanitization of input passed...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

Code injection

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Servlet Container Package...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...