CVE-2002-2142

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper...

CVE-2002-2141

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...

CVE-2002-2177

BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...

CVE-2002-1030

Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...

KPMG-2002029: Bea Weblogic Performance Pack Denial of Service

-------------------------------------------------------------------- Title: Bea Weblogic Performance Pack Denial of Service BUG-ID: 2002029 Released: 8th Jul 2002 -------------------------------------------------------------------- Problem: ======== If the performance pack is enabled, the Bea...

Connection flood DoS against BEA Weblogic

If Performance Pack installed server crashes on connection flood...

KPMG-2002016: Bea Weblogic incorrect URL parsing issues

-------------------------------------------------------------------- Title: Bea Weblogic incorrect URL parsing issues BUG-ID: 2002016 Released: 30th Apr 2002 -------------------------------------------------------------------- Problem: ======== The Bea Weblogic server incorrectly parses certain...

BEA WebLogic Null Byte Request JSP Source Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by adding an encoded character %00x at the end of the request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison and is based on BEAweblogicRevealsourcecode.nasl Script audit an...

BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service

BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service source: https://www.securityfocus.com/bid/4646/info BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions. BEA WebLogic Expre...

BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service

source: https://www.securityfocus.com/bid/4646/info BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions. BEA WebLogic Express provides a platform for serving dynamic data to web and wireless application...

CVE-2002-0106

BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name...

CVE-2002-0106

BEA Systems WebLogic Server 6.1 is affected. The vulnerability allows remote attackers to cause a denial of service by sending a sequence of requests to JSP files that contain an MS-DOS device name. The available documents describe the impact as a DoS but do not provide an exploit vector, affecte...

CVE-2002-0106

BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name...

KPMG-2002003: Bea Weblogic DOS-device Denial of Service

-------------------------------------------------------------------- -=Bea Weblogic DOS-device Denial of Service=- courtesy of KMPG Denmark BUG-ID: 2002003 Released: 8th Jan 2002 -------------------------------------------------------------------- Problem: ======== A flaw in the way the Bea...

DoS через DOS-устройства в Bea Weblogic (DOS DoS)

При обращении к файлу типа aux.jsp операция подвисает...

BEA WebLogic Hex Encoded Request JSP Source Disclosure

The version of BEA WebLogic installed on the remote host may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. %NASLMINLEVEL 70300 This script was written by Gregory Duchemin See the Nessus Scripts License for details...

WebLogic Server Double Dot GET Request Remote Overflow

Requesting an overly long URL starting with a double dot can crash certain versions of WebLogic servers or possibly even allow for arbitrary code execution. %NASLMINLEVEL 70300 This script was written by Vincent Renardias Licence : GPL v2 Changes by Tenable: - Revised plugin title 4/13/2009 - Add...

BEA WebLogic may reveal script source code by URL trickery

Meta comment ------------ The reported problem seems to have been fixed in recent versions, without me talking to BEA. This may indicate that other people have reported the problem before me I was unable to find it on Securityfocus' vulnerability database. It may also mean that the problem is...

Tomcat 3.2.14.0 Weblogic Server 5.1 - URL JSP Request Source Code Disclosure

Tomcat 3.2.14.0 Weblogic Server 5.1 - URL JSP Request Source Code Disclosure source: https://www.securityfocus.com/bid/2527/info BEA Systems WebLogic Server is an enterprise level web and wireless application server. Tomcat can be used together with the Apache web server or a stand alone server f...

Tomcat 3.2.1/4.0 / Weblogic Server 5.1 - URL JSP Request Source Code Disclosure

source: https://www.securityfocus.com/bid/2527/info BEA Systems WebLogic Server is an enterprise level web and wireless application server. Tomcat can be used together with the Apache web server or a stand alone server for Java Servlets and Java Pages. Tomcat ships with a built in web server...