CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

BEA WebLogic Portal 8.1 up to SP5 exposes a session-cache leakage in JSR-168 Portlets, allowing one user to view another user’s Portlet. Root cause: Portlet retrieval from cache for the wrong session. Impact: partial confidentiality breach. Remediation: apply the SP5 patch (CR259534_81SP5.zip) as...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

Design/Logic Flaw

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

Design/Logic Flaw

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1352

CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...

CVE-2006-1351

CVE-2006-1351 affects BEA WebLogic Server 6.1 SP7 and earlier. Affected component: the server’s HTTP-accessible default internal servlet, with a root cause described only as unknown attack vectors. Impact: remote attackers could read arbitrary files. No remediation details are provided in the con...

[SA19310] BEA WebLogic Server/Express Two Vulnerabilities

TITLE: BEA WebLogic Server/Express Two Vulnerabilities SECUNIA ADVISORY ID: SA19310 VERIFY ADVISORY: http://secunia.com/advisories/19310/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: BEA WebLogic Server 8...

BEA WebLogic Portal information leak

Incorrect caching algorithm leads to user's portlet data may be leaked to another portlet...

CVE-2006-1351: Undefined Security Weakness

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1358: Undefined Security Weakness

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

[SA19308] BEA WebLogic Portal JSR-168 Portlets Rendering Security Issue

TITLE: BEA WebLogic Portal JSR-168 Portlets Rendering Security Issue SECUNIA ADVISORY ID: SA19308 VERIFY ADVISORY: http://secunia.com/advisories/19308/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: BEA WebLogic Portal 8.x...

WebLogic Server / WebLogic Express multiple security vulnerabilities

DoS, local filesystem access...

CVE-2006-1352: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2005-4704

Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network...

CVE-2005-4705

BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the...