CVE-2005-4765

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to...

CVE-2002-2177

BEA WebLogic Server and Express 6.1–7.0.0.1 are affected by a vulnerability in how HTTP requests are buffered, which can cause the same response to be sent for two different requests. This could enable remote attackers to view information intended for other users. The issue is described across mu...

CVE-2002-2177

BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...

CVE-2002-2142

Technical details (affected products, versions, root cause, remediation) are not publicly provided in the connected documents; monitor for updates.

CVE-2002-2141

BeA WebLogic Server and Express 7.0/7.0.0.1 running Servlets and EJB on multiple servers are vulnerable to a flaw that, when an application is undeployed on one server, causes removal of security constraints and roles on all servers for affected Servlets or EJBs. This could enable unauthorized ac...

CVE-2000-1238

BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / forward slash characters before the restricted pages...

CVE-2002-2142

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper...

CVE-2002-2141

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...

CVE-2000-1238

The CVE-2000-1238 entry affects BEA Systems WebLogic Express and WebLogic Server 5.1 SP1–SP6. The issue allows remote attackers to bypass access controls for restricted JSP/servlet pages by using a URL that contains multiple forward slash characters before the restricted pages. Vulnerable compone...

CVE-2002-2141: Undefined Security Weakness

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...

CVE-2002-2142: Undefined Security Weakness

An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper...

CVE-2002-2177: Undefined Security Weakness

BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...

WebLogic Server /%00/ bug

Requesting a URL with '%00', '%2e', '%2f' or '%5c' appended to it makes some WebLogic servers dump the listing of the page directory, thus showing potentially sensitive files. An attacker may also use this flaw to view the source code of JSP files, or other dynamic content. Reference :...

WebLogic Server DoS

Requesting an overly long URL starting with a double dot can crash certain version of WebLogic servers. SPDX-FileCopyrightText: 2001 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

WebLogic Server DoS

Requesting an overly long URL starting with a double dot can crash certain version of WebLogic servers. OpenVAS Vulnerability Test $Id: weblogicdotdotdos.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: WebLogic Server DoS Authors: Vincent Renardias Copyright: Copyright C 2001 StrongHoldNet...

WebLogic Server /%00/ bug

Requesting a URL with SPDX-FileCopyrightText: 2001 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:weblogicserver"; ifdescription...

BEA WebLogic Scripts Server scripts Source Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. e.g.: default.js%70 =default.jsp won SPDX-FileCopyrightText: 2001 INTRANODE Some text descriptions might be excerpted from a referenced sources, and are...

WebLogic source code disclosure

There is a bug in the Weblogic web application. Namely, by inserting a /ConsoleHelp/ into a URL, critical source code files may be viewed. SPDX-FileCopyrightText: 2003 John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

BEA WebLogic Operator/Admin Password Disclosure Vulnerability

BEA WebLogic Server and WebLogic Express are prone to a vulnerability that may result in the disclosure of Operator or Admin passwords. SPDX-FileCopyrightText: 2004 Astharot Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

WebLogic management servlet

The remote web server is WebLogic An internal management servlet which does not properly check user credential can be accessed from outside, allowing a cracker to change user passwords, and even upload or download any file on the remote server. In addition to this, there is a flaw in WebLogic 7.0...