4186 matches found
CVE-2017-3531
CVE-2017-3531 affects Oracle WebLogic Server (Servlet Runtime) in Oracle Fusion Middleware, with affected versions 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server, potentially resulting in u...
CVE-2017-3506
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HT...
PT-2017-15942
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks can result in...
Oracle WebLogic Server Remote Vulnerability (CNVD-2017-06089)
Oracle WebLogic Server is a Java application server that fully implements the J2EE 1.5 specification, the latest Web services standards, and the highest level of interoperability standards. Oracle WebLogic Server has a remote security vulnerability that can be exploited by remote attackers to...
Oracle WebLogic Server Multiple Vulnerabilities (April 2017 CPU)
The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Apache Struts component due to improper handling of multithreaded access to an ActionForm instance. An unauthenticated, remote attacke...
Oracle WebLogic Server Remote Vulnerability (CNVD-2017-06030)
Oracle WebLogic Server is a Java application server that fully implements the J2EE 1.5 specification, the latest Web services standards, and the highest level of interoperability standards. An unspecified security vulnerability exists in Oracle WebLogic Server, which can be exploited by remote...
Oracle WebLogic Server Multiple Vulnerabilities (cpuapr2017)
Oracle WebLogic Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bea:weblogicserver";...
Oracle WebLogic Server 'Servlet Runtime' RCE Vulnerability (cpuapr2017)
Oracle WebLogic Server is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Oracle WebLogic Server UnicastRef Insecure Deserialization (CVE-2017-3248)
An insecure deserialization vulnerability has been reported in Oracle WebLogic Server. This vulnerability is due to deseralization of untrusted data while having the UnicastRef class in the code path. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted...
CVE-2017-3248
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...
CVE-2017-3248
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...
Design/Logic Flaw
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...
CVE-2017-3248
CVE-2017-3248 affects Oracle WebLogic Server (Core Components) with affected versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1. It is a Java deserialization RCE in the WebLogic RMI Registry (UnicastRef) that can be exploited remotely for code execution and server takeover via unauthenticated networ...
Oracle WebLogic Java Object RMI Connect-Back Deserialization RCE (January 2017 CPU)
The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the Core Components subcomponent due to unsafe deserialization of Java objects by the RMI registry. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java...
PT-2017-1143 · Oracle · Oracle Fusion Middleware +1
Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 Description: The issue is related to errors in security settings of the Core Components in Oracle Fusion Middleware. Exploitation of this issue can allow a remote...
Oracle WebLogic RMI Registry UnicastRef Object Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle WebLogic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the insufficient blacklisting of certain Java objects. The issue lies in the failure t...
Oracle WebLogic Server Remote Security Vulnerability
Oracle WebLogic Server is an Oracle Oracle application server for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application deployment and...
Oracle WebLogic Server Java Object RMI Connect-Back Deserialization RCE (January 2017 CPU)
The version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the Core Components subcomponent due to unsafe deserialization of Java objects by the RMI registry. An unauthenticated, remote attacker can exploit this, via a crafted Java...
