CVE-2004-0711: Undefined Security Weakness

The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "" as wildcards as if they were the legal "/" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected...

CVE-2004-0652

CVE-2004-0652 affects BEA WebLogic Server and WebLogic Express (versions 7.0 with SP4, and 8.1 with SP2). The vulnerability arises from accessible internal methods that allow an attacker to obtain the boot credentials (username and password) needed to start the server. Impact is credential leakag...

CVE-2004-0652

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...

CVE-2004-0652: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0471

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service service shutdown...

BEA WebLogic Server contains vulnerability in handling of certain tags when editing "weblogic.xml"

Overview BEA WebLogic Server contains a vulnerability in the way Weblogic Builder and the SecurityRoleAssignmentMBean.toXML method parse certain tags in the weblogic.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing,...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express versions 7.0–SP5 and 8.1–SP2 are affected. When editing weblogic.xml via WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, the process can inadvertently remove security-role-assignment tags if weblogic.xml lacks a principal-name tag, potent...

CVE-2004-0471

The CVE affects BEA WebLogic Server and WebLogic Express 7.0–SP5 and 8.1–SP2. The underlying issue is that the server does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, enabling unauthorized users to cause a denial of service (...

CVE-2004-0470

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

CVE-2004-0471

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service service shutdown...

CVE-2004-0471: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service service shutdown...

CVE-2004-0470: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remov...

Security Advisory: (BEA04-60.00)

Security Advisory: BEA04-60.00 From: BEA Systems Inc. Minor Subject: Patches are available to protect user authorizations. Products Affected: WebLogic Server and WebLogic Express Threat level: Low - The vulnerability requires an attacker to be assigned the Admin or Operator security role. Severit...

Bea weblogic shwutdown limitations bypass

User with admin or operator pribvileges can shutdown server even if this operation is restricted...

BEA WebLogic Server contains a vulnerability in the URL pattern matching

Overview There is a vulnerability in the URL pattern matching functionality of BEA WebLogic Server that could allow URL restrictions to be bypassed. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and...

BEA WebLogic Server allows unauthorized removal of EJB objects

Overview There is a vulnerability in the BEA WebLogic Server that could allow the unauthorized removal of an Enterprise JavaBean EJB. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...

BEA WebLogic Server configuration wizard stores administrative credentials in clear text log files

Overview There is a vulnerability in BEA WebLogic Server in which a user with access to log files generated by the configuration wizard could obtain the administrative username and password. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure fo...

BEA WebLogic Server fails to properly validate certificate chains

Overview There is a vulnerability in BEA WebLogic Server in which certificate chains rejected by the custom trust manager could still be accepted by the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...

BEA WebLogic Server internal methods may disclose sensitive information

Overview There is a vulnerability in BEA WebLogic Server that could allow users to obtain the credentials of the user who booted the server. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...