4175 matches found
CVE-2005-0432
CVE-2005-0432 affects BEA WebLogic Server 7.0 SP5 and earlier and 8.1 SP3 and earlier. The issue is that authentication attempts generate different login exceptions, which can aid remote attackers in guessing passwords via brute force. The connected records confirm this behavior as the root cause...
CVE-2005-0432
BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks...
BEA WebLogic < 8.1.0 SP4 Information Disclosure
Binary data 2615.prm...
CVE-2004-1755
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges...
CVE-2004-1757
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges...
CVE-2004-2320
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...
CVE-2004-2696
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation RMI over Internet Inter-ORB Protocol IIOP, does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in a...
CVE-2004-2320
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...
CVE-2004-2321
BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including 1 ServerStartMBean.Password and 2 NodeManagerMBean.CertificatePassword...
CVE-2004-2424
BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...
PT-2004-3214
Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 5.1 through SP13 BEA WebLogic Server and Express versions 6.1 through SP6 BEA WebLogic Server and Express versions 7.0 through SP4 BEA WebLogic Server and Express versions 8.1 through SP2 Description:...
[SA12524] BEA WebLogic Multiple Vulnerabilities
TITLE: BEA WebLogic Multiple Vulnerabilities SECUNIA ADVISORY ID: SA12524 VERIFY ADVISORY: http://secunia.com/advisories/12524/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data, Exposure of system information, Exposure of sensitive information, DoS WHERE: From remote...
BEA WebLogic < 8.1.0 SP 3 Multiple Vulnerabilities
Binary data 2282.prm...
WebLogic < 8.1 SP3 Multiple Vulnerabilities
According to its banner, the remote web server is BEA WebLogic version 8.1 SP2 or older. There are multiple vulnerabilities in such versions that may allow unauthorized access on the remote host or to get the content of the remote JSP scripts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
WebLogic Internal Management Servlet Authentication Bypass
Binary data 1455.prm...
WebLogic FileServlet Source Code Disclosure
Binary data 1631.prm...
WebLogic Server < 6.0 SP1 Encoded Request Directory Listing
Binary data 1453.prm...
WebLogic Server < 5.1 SP 7 ".." URL Handling Remote Overflow DoS
Binary data 1454.prm...