CVE-2004-1757

BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges...

CVE-2004-2696

BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation RMI over Internet Inter-ORB Protocol IIOP, does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in a...

CVE-2004-1755

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2004-2424

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

PT-2004-3214

Name of the Vulnerable Software and Affected Versions: BEA WebLogic Server and Express versions 5.1 through SP13 BEA WebLogic Server and Express versions 6.1 through SP6 BEA WebLogic Server and Express versions 7.0 through SP4 BEA WebLogic Server and Express versions 8.1 through SP2 Description:...

CVE-2004-2320: Exposure of Sensitive Information to an Unauthorized Actor

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

[SA12524] BEA WebLogic Multiple Vulnerabilities

TITLE: BEA WebLogic Multiple Vulnerabilities SECUNIA ADVISORY ID: SA12524 VERIFY ADVISORY: http://secunia.com/advisories/12524/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data, Exposure of system information, Exposure of sensitive information, DoS WHERE: From remote...

BEA WebLogic < 8.1.0 SP 3 Multiple Vulnerabilities

Binary data 2282.prm...

WebLogic < 8.1 SP3 Multiple Vulnerabilities

According to its banner, the remote web server is BEA WebLogic version 8.1 SP2 or older. There are multiple vulnerabilities in such versions that may allow unauthorized access on the remote host or to get the content of the remote JSP scripts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

WebLogic Server < 5.1 SP 7 ".." URL Handling Remote Overflow DoS

Binary data 1454.prm...

WebLogic Server < 6.0 SP1 Encoded Request Directory Listing

Binary data 1453.prm...

WebLogic Internal Management Servlet Authentication Bypass

Binary data 1455.prm...

WebLogic FileServlet Source Code Disclosure

Binary data 1631.prm...

BEA WebLogic < 5.1.0 SP8 Hex-encoded Request JSP Source Disclosure

Binary data 1525.prm...

BEA WebLogic Server GET Request Name Disclosure

Binary data 1536.prm...

BEA WebLogic < 5.1 SP 11 JSP Source Disclosure

Binary data 1538.prm...

BEA WebLogic < 6.1 SP2 Encoded Null Byte Request JSP Source Disclosure

Binary data 1526.prm...

CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...