4180 matches found
CVE-2002-2177
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...
CVE-2000-1238
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / forward slash characters before the restricted pages...
CVE-2002-2142
Technical details (affected products, versions, root cause, remediation) are not publicly provided in the connected documents; monitor for updates.
CVE-2000-1238
The CVE-2000-1238 entry affects BEA Systems WebLogic Express and WebLogic Server 5.1 SP1–SP6. The issue allows remote attackers to bypass access controls for restricted JSP/servlet pages by using a URL that contains multiple forward slash characters before the restricted pages. Vulnerable compone...
CVE-2002-2141
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...
CVE-2002-2141
BeA WebLogic Server and Express 7.0/7.0.0.1 running Servlets and EJB on multiple servers are vulnerable to a flaw that, when an application is undeployed on one server, causes removal of security constraints and roles on all servers for affected Servlets or EJBs. This could enable unauthorized ac...
WebLogic Server /%00/ bug
Requesting a URL with '%00', '%2e', '%2f' or '%5c' appended to it makes some WebLogic servers dump the listing of the page directory, thus showing potentially sensitive files. An attacker may also use this flaw to view the source code of JSP files, or other dynamic content. Reference :...
WebLogic management servlet
The remote web server is WebLogic An internal management servlet which does not properly check user credential can be accessed from outside, allowing a cracker to change user passwords, and even upload or download any file on the remote server. In addition to this, there is a flaw in WebLogic 7.0...
BEA WebLogic Operator/Admin Password Disclosure Vulnerability
The remote web server is running WebLogic. BEA WebLogic Server and WebLogic Express are reported prone to a vulnerability that may result in the disclosure of Operator or Admin passwords. An attacker who has interactive access to the affected managed server, may potentially exploit this issue in ...
WebLogic Server DoS
Requesting an overly long URL starting with a double dot can crash certain version of WebLogic servers. OpenVAS Vulnerability Test $Id: weblogicdotdotdos.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: WebLogic Server DoS Authors: Vincent Renardias Copyright: Copyright C 2001 StrongHoldNet...
WebLogic source code disclosure
There is a bug in the Weblogic web application. Namely, by inserting a /ConsoleHelp/ into a URL, critical source code files may be viewed. OpenVAS Vulnerability Test $Id: consolehelp.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: WebLogic source code disclosure Authors: John Lampe...
BEA WebLogic Management Servlet Multiple Vulnerabilities (BEA03-28)
BEA WebLogic is prone to multiple vulnerabilities in a management servlet. SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
BEA WebLogic Scripts Server scripts Source Disclosure
BEA WebLogic may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. e.g.: default.js%70 =default.jsp won SPDX-FileCopyrightText: 2001 INTRANODE Some text descriptions might be excerpted from a referenced sources, and are...
WebLogic Server DoS
Requesting an overly long URL starting with a double dot can crash certain version of WebLogic servers. SPDX-FileCopyrightText: 2001 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
WebLogic source code disclosure
There is a bug in the Weblogic web application. Namely, by inserting a /ConsoleHelp/ into a URL, critical source code files may be viewed. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...
BEA WebLogic Operator/Admin Password Disclosure Vulnerability
BEA WebLogic Server and WebLogic Express are prone to a vulnerability that may result in the disclosure of Operator or Admin passwords. SPDX-FileCopyrightText: 2004 Astharot Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
WebLogic Server /%00/ bug
Requesting a URL with SPDX-FileCopyrightText: 2001 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:weblogicserver"; ifdescription...
[SA17138] BEA WebLogic 24 Vulnerabilities and Security Issues
TITLE: BEA WebLogic 24 Vulnerabilities and Security Issues SECUNIA ADVISORY ID: SA17138 VERIFY ADVISORY: http://secunia.com/advisories/17138/ CRITICAL: Moderately critical IMPACT: Security Bypass, Cross Site Scripting, Manipulation of data, Brute force, Exposure of system information, Exposure of...
Cross-site scripting vulnerability in BEA WebLogic administration console
I. DESCRIPTION A cross-site scripting issue affects the display of error events in the 'View Error Log' feature of BEA WebLogic Administration console. II. AFFECTED PRODUCTS BEA WebLogic 8.1 SP4 and previous. III. HOW TO VERIFY 1. Make a HTTP request containing XSS code to a target Web server $...