4178 matches found
CVE-2005-1748
The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service...
CVE-2005-1748
The CVE-2005-1748 issue affects BEA WebLogic Server and WebLogic Express, specifically the embedded LDAP server in versions 8.1 through Service Pack 4 and 7.0 through Service Pack 5. The root cause is the LDAP server allowing remote anonymous binds, which may enable remote attackers to view user ...
CVE-2005-1749
Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service CPU consumption from thread looping...
CVE-2005-1747
CVE-2005-1747 describes multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express (BEA WebLogic 8.1/Express 8.1 up to SP4, and 7.0 up to SP6). The issues allow remote attackers to inject arbitrary script/HTML via login parameters (j_username, j_password), or through p...
CVE-2005-1746
CVE-2005-1746 affects BEA WebLogic Server 7.0 up to Service Pack 5. The cluster cookie parsing code may contact any host/port specified in a cookie, even if not in the cluster, allowing remote attackers to cause a denial of service (cluster slowdown) via modified cookies. The provided sources do ...
PT-2005-2716 · Bea · Weblogic Express +1
Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and WebLogic Express versions 7.0 through Service Pack 5 Description: The issue allows users to continue accessing an application without having to log in again after the application is redeployed. This may violate newly...
BEA WebLogic <= 8.1 SP4 Multiple Vulnerabilities (XSS, DoS, ID, more)
According to its banner, the remote host is running a version of BEA WebLogic Server or WebLogic Express that is prone to multiple vulnerabilities. These flaws could lead to buffer overflows, denial of service, unauthorized access, cross-site scripting attacks, and information disclosure. C Tenab...
CVE-2005-0432
BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks...
BEA WebLogic < 8.1 SP5 Multiple Vulnerabilities
Binary data 2862.prm...
BEA WebLogic Server 8.1 WebLogic Express Administration Console - Cross-Site Scripting
BEA WebLogic Server 8.1 WebLogic Express Administration Console - Cross-Site Scripting source: https://www.securityfocus.com/bid/13400/info A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebLogic Express administration console. This issue is due to a failure of the...
CVE-2004-1756
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers...
CVE-2003-1093
BEA WebLogic Server versions 6.1, 7.0 and 7.0.0.1 expose a vulnerability where, when routing messages to a JMS target domain that is inaccessible, a ResourceAllocationException may cause the user’s password to be leaked. The issue affects the JMS routing path and has partial impact on confidentia...
CVE-2004-1758
BEA WebLogic Server/Express (versions 8.1 up to SP2, 7.0 up to SP4, 6.1 up to SP6) may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, enabling local users to gain privileges. Root cause: credentials stored in plaintext within config.xml...
CVE-2003-1094
Technical details for CVE-2003-1094 are not provided in the connected documents; only the BEA WebLogic 7.0 SP3 issue is described. Monitor for updates.
CVE-2004-1757
CVE-2004-1757 affects BEA WebLogic Server and WebLogic Express 8.1, SP1 and earlier. The issue is that the administrator password is stored in cleartext in config.xml, allowing local users to gain privileges. The vulnerability is rooted in improper password storage on the affected server, with lo...
CVE-2004-1757
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges...
CVE-2004-1756
BEA WebLogic Server and WebLogic Express (versions up to 8.1 SP2 and earlier; 7.0 SP4 and earlier) are affected when using 2-way SSL with a custom trust manager. The vulnerability allows a certificate chain to be accepted even if the trust manager rejects it, enabling remote attackers to spoof ot...
CVE-2003-1095
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...
CVE-2003-1094
BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges...