CVE-2004-2696

BEA WebLogic Server/Express versions 6.1, 7.0, and 8.1 with RMI over IIOP are affected. The issue arises when multiple logins from the same client occur, potentially causing an incorrect or “unexpected user identity” to be used in an RMI call. The available documents describe the affected product...

BEA WebLogic Server空密码组信息泄露漏洞

BUGTRAQ ID: 25472 BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Systems WebLogic在处理SSL连接时存在漏洞，可能导致敏感信息泄露。 在某些情况下，运行在服务器环境以外的SSL客户端可能无法找到创建SSL密码组列表所需的所有密码，这就会导致使用默认的非加密密码；客户端也可能无法支持服务器中任何可用的密码组，这时服务器就会选择使用空密码的密码组，导致SSL通讯没有加密，这样攻击者就可以获取明文传输的信息。 BEA Systems Weblogic Server 9.2...

CVE-2007-4615

The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications...

CVE-2007-4617

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service server thread hang via unspecified vectors...

Code injection

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service server thread hang via unspecified vectors...

CVE-2007-4618

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service disk consumption via certain malformed HTTP headers...

CVE-2007-4614

BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426...

Code injection

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service disk consumption via certain malformed HTTP headers...

Design/Logic Flaw

BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426...

CVE-2007-4613

SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a differen...

CVE-2007-4617

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service server thread hang via unspecified vectors...

CVE-2007-4613

CVE-2007-4613 affects BEA WebLogic Server SSL libraries (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP5). Vulnerability: an attacker in a MITM can obtain plaintext from an SSL stream by injecting crafted data and measuring timing of error responses. This is a separate issue from CVE-2006-2461....

CVE-2007-4614

CVE-2007-4614 describes BEA WebLogic-related vulnerability where an admin server security policy change log is not properly propagated to temporarily unavailable managed servers, potentially allowing attackers to bypass applied restrictions. The connected records indicate a related entry (CVE-200...

CVE-2007-4617

CVE-2007-4617 affects BEA WebLogic Server (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP4). The vulnerability description cites an unspecified issue that allows remote attackers to cause a denial-of-service via unspecified vectors. The connected documents do not provide concrete exploitation d...

CVE-2007-4618

Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service disk consumption via certain malformed HTTP headers...

CVE-2007-4618

CVE-2007-4618 affects BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7. The issue is an unspecified vulnerability that allows remote attackers to cause a denial of service via certain malformed HTTP headers, leading to disk consumption. The provided documents do not include expli...

CVE-2007-4616

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept...

CVE-2007-4614

BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426...

CVE-2007-4615

The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications...

CVE-2007-4615

The CVE-2007-4615 entry concerns BEA WebLogic Server’s SSL client implementation. Affected versions include BEA WebLogic Server 7.0 SP7, 8.1 SP2–SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0. The vulnerability arises when the SSL client sometimes selects the null cipher if other ciphers are avail...