2979 matches found
CVE-2005-4749
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors...
CVE-2005-4758
Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP...
CVE-2005-4761
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which may include passwords or keyphrases in the server log when the -D option is used. Affected products/versions are described in mult...
CVE-2005-4761
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information passwords or keyphrases in the server log file when the -D option is used...
Design/Logic Flaw
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...
CVE-2006-1351
BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...
CVE-2006-1351
CVE-2006-1351 affects BEA WebLogic Server 6.1 SP7 and earlier. Affected component: the server’s HTTP-accessible default internal servlet, with a root cause described only as unknown attack vectors. Impact: remote attackers could read arbitrary files. No remediation details are provided in the con...
CVE-2006-1352
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...
CVE-2006-1351
BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...
CVE-2006-1352
CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...
[SA19310] BEA WebLogic Server/Express Two Vulnerabilities
TITLE: BEA WebLogic Server/Express Two Vulnerabilities SECUNIA ADVISORY ID: SA19310 VERIFY ADVISORY: http://secunia.com/advisories/19310/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: BEA WebLogic Server 8...
WebLogic Server / WebLogic Express multiple security vulnerabilities
DoS, local filesystem access...
CVE-2005-4704
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network...
CVE-2005-4704
The CVE-2005-4704 entry describes an unspecified vulnerability in BEA WebLogic Server and WebLogic Express (versions 8.1–SP3, 7.0–SP6, 6.1–SP7) where, when SSL is intended to be used, an unencrypted protocol is used in certain circumstances. This leads to user credentials being sent in the clear ...
CVE-2005-4705
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the...
Code injection
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors...
CVE-2006-0432
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources...
Code injection
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges...
CVE-2006-0419
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service unspecified via a large number of connections...