3003 matches found
CVE-2004-0471
The CVE affects BEA WebLogic Server and WebLogic Express 7.0–SP5 and 8.1–SP2. The underlying issue is that the server does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, enabling unauthorized users to cause a denial of service (...
CVE-2004-0470
BEA WebLogic Server and WebLogic Express versions 7.0–SP5 and 8.1–SP2 are affected. When editing weblogic.xml via WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, the process can inadvertently remove security-role-assignment tags if weblogic.xml lacks a principal-name tag, potent...
Security Advisory: (BEA04-60.00)
Security Advisory: BEA04-60.00 From: BEA Systems Inc. Minor Subject: Patches are available to protect user authorizations. Products Affected: WebLogic Server and WebLogic Express Threat level: Low - The vulnerability requires an attacker to be assigned the Admin or Operator security role. Severit...
BEA WebLogic Server contains a vulnerability in the URL pattern matching
Overview There is a vulnerability in the URL pattern matching functionality of BEA WebLogic Server that could allow URL restrictions to be bypassed. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and...
BEA WebLogic Server configuration wizard stores administrative credentials in clear text log files
Overview There is a vulnerability in BEA WebLogic Server in which a user with access to log files generated by the configuration wizard could obtain the administrative username and password. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure fo...
BEA WebLogic Server allows unauthorized removal of EJB objects
Overview There is a vulnerability in the BEA WebLogic Server that could allow the unauthorized removal of an Enterprise JavaBean EJB. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...
BEA WebLogic Server internal methods may disclose sensitive information
Overview There is a vulnerability in BEA WebLogic Server that could allow users to obtain the credentials of the user who booted the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...
BEA WebLogic Server fails to properly validate certificate chains
Overview There is a vulnerability in BEA WebLogic Server in which certificate chains rejected by the custom trust manager could still be accepted by the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...
BEA WebLogic Server stores database password in clear text in "config.xml"
Overview WebLogic Server contains a vulnerability that may expose the database username and password in clear text in the config.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...
BEA WebLogic Server fails to properly associate re-created groups
Overview WebLogic Server contains a vulnerability that could result in the creation of new groups inheriting the privileges of a previously deleted group if members of the deleted group still exist. Description BEA Systems describes WebLogic Server as "an industrial-strength application...
CVE-2004-1756
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers...
CVE-2004-1758
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges...
BEA WebLogic Server stores administrator password in clear text in config.xml
Overview BEA WebLogic Server stores the administrator password used to boot the server in clear text within the config.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing distributed...
BEA WebLogic Server fails to properly associate the user identity on subsequent client connections
Overview BEA WebLogic Server fails to properly associate a user's identity when a client attempts to connect multiple times using different client certificates. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...
CVE-2003-1221
BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL t3s is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions...
CVE-2003-1438
Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user...
CVE-2003-1290
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface JNDI...
CVE-2003-1094
BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges...
CVE-2003-1226
BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords...