beaXSS.txt

I. DESCRIPTION A cross-site scripting issue affects the display of error events in the 'View Error Log' feature of BEA WebLogic Administration console. II. AFFECTED PRODUCTS BEA WebLogic 8.1 SP4 and previous. III. HOW TO VERIFY 1. Make a HTTP request containing XSS code to a target Web server $...

BEA WebLogic 7.08.1 - Administration Console Cross-Site Scripting

BEA WebLogic 7.08.1 - Administration Console Cross-Site Scripting source: https://www.securityfocus.com/bid/14657/info BEA WebLogic administration console is prone to cross-site scripting attacks. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...

BEA WebLogic 7.0/8.1 - Administration Console Cross-Site Scripting

source: https://www.securityfocus.com/bid/14657/info BEA WebLogic administration console is prone to cross-site scripting attacks. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may...

CVE-2005-2680

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP4, when using entitlements, allows remote attackers to bypass access restrictions for the pages of a Book via crafted URLs...

CVE-2005-2680

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP4, when using entitlements, allows remote attackers to bypass access restrictions for the pages of a Book via crafted URLs...

CVE-2005-2680

The CVE-2005-2680 entry concerns BEA WebLogic Portal 8.1 through SP4. The vulnerability occurs when using entitlements and allows remote attackers to bypass access restrictions for pages of a Book via crafted URLs. This is described as an unspecified vulnerability with impact limited to bypassing...

CVE-2004-2424

This CVE concerns BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2. A vulnerability in HTTPS session handling allows remote attackers to cause a denial of service by consuming network ports, with the server failing to release ports after a session ends. The vulnerability is described ...

CVE-2004-2424

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2003-1221

The CVE concerns BEA WebLogic Express and WebLogic Server versions 7.0–8.1 SP 1. In certain configurations, a request to use T3 over SSL (t3s) sent to the insecure T3 port could cause a non-SSL connection to be used for the communication, allowing session sniffing. The connected sources (NVD/CVE ...

CVE-2003-1225

The vulnerability CVE-2003-1225 affects BEA WebLogic Server and Express 7.0 and 7.0.0.1, where the default CredentialMapper stores passwords in cleartext on disk, enabling local users to extract passwords. The related Nessus entry corroborates a local-access information disclosure risk, including...

CVE-2003-1225

The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords...

CVE-2003-1220

BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service proxy plugin crash via a malformed URL...

CVE-2003-1220

BEA WebLogic Server proxy plugin for BEA WebLogic Express and WebLogic Server 6.1–8.1 SP1 is affected by a DoS vulnerability where a malformed URL can crash the proxy plugin. Product/versions: BEA WebLogic Server proxy plugin for WebLogic Express and Server 6.1 through 8.1 SP1. Root cause: handli...

CVE-2003-1226

The CVE-2003-1226 entry concerns BEA WebLogic Server and Express versions 7.0 and 7.0.0.1 where secrets used for password encryption are stored insecurely in config.xml, filerealm.properties, and weblogic-rar.xml. This storage flaw enables a local attacker to read those secrets and decrypt passwo...

CVE-2003-1226

BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords...

CVE-2003-1223

The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service Node Manager crash via malformed data to the Node Manager's port, as demonstrated by nmap...

CVE-2003-1222

CVE-2003-1222 affects BEA WebLogic Express/Server 8.0–8.1 SP1 when using a foreign JMS provider. The underlying issue is that the system echoes the foreign provider password to the console and stores it in cleartext in config.xml, enabling an attacker to obtain the password. The description does ...

CVE-2003-1224

Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing "shoulder surfing" the screen...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...