WebLogic Server < 6.0 SP1 Encoded Request Directory Listing

Binary data 1453.prm...

BEA WebLogic Server GET Request Name Disclosure

Binary data 1536.prm...

CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...

CVE-2004-0712

The configuration tools 1 config.sh in Unix or 2 config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges...

CVE-2004-0715

The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group membe...

CVE-2004-0713

The remove method in a stateful Enterprise JavaBean EJB in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from...

CVE-2004-0711

The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "" as wildcards as if they were the legal "/" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected...

CVE-2004-0712

The configuration tools 1 config.sh in Unix or 2 config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges...

CVE-2004-0715

The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group membe...

CVE-2004-0713

The CVE-2004-0713 case affects BEA WebLogic Server and WebLogic Express, versions 8.1–SP2, 7.0–SP4, and 6.1–SP6. The vulnerability is in the remove method of a stateful Enterprise JavaBean (EJB), where EJB permissions are not properly checked before unexporting a bean. This allows remote authenti...

CVE-2004-0711

The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "" as wildcards as if they were the legal "/" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected...

CVE-2004-0652

CVE-2004-0652 affects BEA WebLogic Server and WebLogic Express (versions 7.0 with SP4, and 8.1 with SP2). The vulnerability arises from accessible internal methods that allow an attacker to obtain the boot credentials (username and password) needed to start the server. Impact is credential leakag...

CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0471

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service service shutdown...

BEA WebLogic Server contains vulnerability in handling of certain tags when editing "weblogic.xml"

Overview BEA WebLogic Server contains a vulnerability in the way Weblogic Builder and the SecurityRoleAssignmentMBean.toXML method parse certain tags in the weblogic.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing,...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0471

The CVE affects BEA WebLogic Server and WebLogic Express 7.0–SP5 and 8.1–SP2. The underlying issue is that the server does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, enabling unauthorized users to cause a denial of service (...

CVE-2004-0471

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service service shutdown...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express versions 7.0–SP5 and 8.1–SP2 are affected. When editing weblogic.xml via WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, the process can inadvertently remove security-role-assignment tags if weblogic.xml lacks a principal-name tag, potent...