BEA WebLogic FileServlet Source Code Disclosure

The version of the WebLogic web application installed on the remote host contains a flaw such that by inserting a /ConsoleHelp/ into a URL, critical source code files may be viewed. %NASLMINLEVEL 70300 This script was written by John [email protected] Modifications by Tenable Network...

BEA WebLogic Server and Express 7.x Passwords Disclosure

------------------------------------------------------------ BEA WebLogic Server and Express 7.x Passwords Disclosure ------------------------------------------------------------ Affected Versions ----------------- BEA WebLogic Server 7.x BEA WebLogic Express 7.x ADVISORY -------- This...

WebLogic Multiple Method Cleartext Password Disclosure

The remote web server is running WebLogic 7.0 or 7.0.0.1. There is a bug in these versions that could allow a local attacker to recover a WebLogic password if the screen of the WebLogic server is visible. In addition, a local user may be able to view cryptographic secrets, thereby facilitating...

WebLogic SSL Certificate Chain User Spoofing

The remote web server is running WebLogic. There is a bug in this version that could allow an attacker to perform a man-in-the-middle attack against the remote server by supplying a self-signed certificate. An attacker with a legitimate certificate could use this flaw to impersonate any other use...

WebLogic Crafted GET Request Hostname Disclosure

The remote WebLogic server discloses its NetBIOS host name when it is issued a request generating a redirection. An attacker may use this information to better prepare other attacks against this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

BEA WebLogic SSIServlet Invocation Source Code Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by prefixing the path to the .jsp files by /.shtml/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script is based on BEAweblogicRevealsourcecode.nasl Script audit and contributions from Carmichael Security Erik...

CVE-2002-1030

Technical details (affected components, root cause, impact, remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2002-1030

Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...

BEA WebLogic 7.0 - Hostname/NetBIOS Name Remote Information Disclosure

source: https://www.securityfocus.com/bid/7257/info It has been reported that some types of requests may result in sensitive information disclosure. From this, an attacker may be able to launch a more organized attack against vulnerable hosts. GET . HTTP/1.0\r\n\r\n And also: ./ .// .////////////...

BEA WebLogic 7.0 - HostnameNetBIOS Name Remote Information Disclosure

BEA WebLogic 7.0 - HostnameNetBIOS Name Remote Information Disclosure source: https://www.securityfocus.com/bid/7257/info It has been reported that some types of requests may result in sensitive information disclosure. From this, an attacker may be able to launch a more organized attack against...

WebLogic Servlets Multiple Vulnerabilities

The remote web server is WebLogic. An internal management servlet that does not properly check user credentials can be accessed from outside, allowing an attacker to change user passwords, and even upload or download any file on the remote server. In addition to this, there is a flaw in WebLogic...

BEA WebLogic Server fails to discard cached authentication information when web applications are updated

Overview The BEA WebLogic server contains a vulnerability that may allow authenticated users to bypass authentication for a given web application when the application has been updated. Description The BEA WebLogic Server provides a feature that allows it to store user authentication information f...

CVE-2003-0151

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...

CVE-2003-0151

CVE-2003-0151 affects BEA WebLogic Server and Express versions 6.0–7.0. The vulnerability is an access-control flaw in internal admin servlets that may allow remote attackers to read arbitrary files or execute arbitrary code. The connected sources confirm the affected products and the nature of t...

CVE-2003-0151

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...

CVE-2003-1095

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...

Bea Weblogic multiple bugs

It's possible to download, upload and execute any file...

SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express

Remote Administration of BEA WebLogic Server and Express Release Date: March 18, 2003 Severity: High Systems Affected: • WebLogic Server and Express 6.0 • WebLogic Server and Express 6.1 • WebLogic Server and Express 7.0 Description: SPI Labs and S21sec have identified a serious vulnerability tha...

S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server

ID: S21SEC-011-en Title: Multiple vulnerabilities in BEA WebLogic Server Date: 7/01/2003 Status: Patch published Scope: Remote command execution Platforms: Linux, Windows 2000, probably others Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-011-en.txt Release: Public S 2 1 S E C...

BEA WebLogic Server "ResourceAllocationException" exception may disclose user password

Overview A vulnerability in BEA's WebLogic Server may disclose sensitive information. Description From the BEA WebLogic Server 7.0 Overview:BEA WebLogic Server is a fully featured, standards-based application server providing the foundation on which an enterprise can build its applications. BEA...