CVE-2003-1222: Undefined Security Weakness

BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service JMS provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password...

CVE-2003-1225: Undefined Security Weakness

The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords...

CVE-2003-1221: Undefined Security Weakness

BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL t3s is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions...

BEA05-V0101.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console login page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0101 http://www.appsecinc.com/resources/alerts/general/BEA-002.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

BEA05-V0100.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console error page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0100 http://www.appsecinc.com/resources/alerts/general/BEA-001.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

FreeBSD : apache -- http request smuggling (651996e0-fe07-11d9-8329-000e0c2e438a)

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

apache -- http request smuggling

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this...

CVE-2005-2092

BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forwar...

CVE-2005-2092

The CVE-2005-2092 entry describes a vulnerability in BEA Systems WebLogic 8.1 SP1 where a crafted HTTP request with both a Transfer-Encoding: chunked header and a Content-Length header causes WebLogic to mis-handle the request body, leading to HTTP Request Smuggling. This can allow remote attacke...

CVE-2005-2092

BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forwar...

CVE-2005-2092: Undefined Security Weakness

BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forwar...

Bea Weblogic application server Server Console crossite scripting

Crossite scripting; no session cookie timeout is implemented...

[AppSecInc Advisory BEA05-V0101] BEA WebLogic Administration Console login page cross-site scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console login page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0101 http://www.appsecinc.com/resources/alerts/general/BEA-002.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

[AppSecInc Advisory BEA05-V0100] BEA WebLogic Administration Console error page cross-site scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 BEA WebLogic Administration Console error page cross-site scripting vulnerability AppSecInc Team SHATTER Security Advisory BEA05-V0100 http://www.appsecinc.com/resources/alerts/general/BEA-001.html May 27, 2005 Affected versions: BEA WebLogic Server 7...

BEA WebLogic 7.08.1 - Administration Console LoginForm.jsp Cross-Site Scripting

BEA WebLogic 7.08.1 - Administration Console LoginForm.jsp Cross-Site Scripting source: https://www.securityfocus.com/bid/13793/info BEA WebLogic Server And WebLogic Express are affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitiz...

BEA WebLogic 7.0/8.1 - Administration Console Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/13794/info BEA WebLogic Server And WebLogic Express are affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the error page. A successful attack may facilitate the...

BEA WebLogic 7.08.1 - Administration Console Error Page Cross-Site Scripting

BEA WebLogic 7.08.1 - Administration Console Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/13794/info BEA WebLogic Server And WebLogic Express are affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize...

BEA WebLogic 7.0/8.1 - Administration Console LoginForm.jsp Cross-Site Scripting

source: https://www.securityfocus.com/bid/13793/info BEA WebLogic Server And WebLogic Express are affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'LoginForm.jsp' script. An attacker may leverage th...

ACROS Security: HTML Injection in BEA WebLogic Server Console (2)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2005-05-24-2 ------------------------------------------------------------------------- ASPR 2005-05-24-2: HTML Injection in BEA WebLogic Server Console 2...

ACROS Security: HTML Injection in BEA WebLogic Server Console (1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2005-05-24-1 ------------------------------------------------------------------------- ASPR 2005-05-24-1: HTML Injection in BEA WebLogic Server Console 1...