CVE-2009-1006

Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

CVE-2009-1005

Affected products include BEA/Oracle AquaLogic Data Services Platform 3.0/3.2 and Oracle Data Service Integrator 10.3.0, among others. CVE-2009-1005 is described as an unspecified local vulnerability affecting confidentiality, integrity, and availability via unknown vectors. The connected documen...

CVE-2009-1001

CVE-2009-1001 affects Oracle BEA WebLogic Portal 8.1 Gold through SP6. The description indicates an unspecified vulnerability that allows remote authenticated users to gain privileges via unknown vectors, with a CVSS v2 base score of 5.5 (MEDIUM). No concrete exploit vectors or impacted subcompon...

CVE-2009-1004

CVE-2009-1004 refers to an unspecified vulnerability in BEA WebLogic Server 10.3 within BEA Product Suite 10.3 that could affect confidentiality and integrity via remote, unknown vectors. Connected sources corroborate that Oracle issued a multi-vulnerability CPUAPR2009 patch update in April 2009 ...

CVE-2009-1006

CVE-2009-1006 concerns an unspecified vulnerability in the JRockit component of BEA Product Suite (R27.6.2 and earlier) when used with SDK/JRE 1.4.2, JRE/JDK 5, or JRE/JDK 6. It enables remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Connected document...

CVE-2009-1016

CVE-2009-1016 concerns a buffer overflow in BEA/Oracle WebLogic Server Plugins related to parsing SSL certificates. The vulnerability affects WebLogic Server Plug-ins across multiple BEA/Oracle versions and can be triggered by a crafted certificate, potentially impacting confidentiality, integrit...

CVE-2009-1012

Affected software: Oracle BEA WebLogic Server plug-ins for Apache and IIS web servers (versions 7.0 Gold–SP7, 8.1 Gold–SP6, 9.0/9.1/9.2 Gold–MP3, 10.0 Gold–MP1, 10.3). The vulnerability is described as an integer overflow in an unspecified plug-in that parses HTTP requests, potentially causing a ...

CVE-2009-1003

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect integrity via unknown vectors related to "access to source code of web pages."...

CVE-2009-1016

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote authenticated users to affect confidentiality, integrity, and availability, related to IIS. NOTE: the previous information was obtained from the...

CVE-2009-1012

Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE:...

CVE-2009-1001

Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknown vectors...

CVE-2009-1004

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and integrity via unknown vectors...

CVE-2009-1002

Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, and 7.0 Gold through SP7 allows remote attackers to gain privileges via unknown vectors...

CVE-2009-1005

Unspecified vulnerability in the Oracle Data Service Integrator AquaLogic Data Services Platform component in BEA Product Suite 10.3.0, 3.2, 3.0.1, and 3.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors...

BEA WebLogic JSESSIONID Cookie Value Overflow

This module exploits a buffer overflow in BEA's WebLogic plugin. The vulnerable code is only accessible when clustering is configured. A request containing a long JSESSION cookie value can lead to arbitrary code execution. This module requires Metasploit: https://metasploit.com/download Current...

Oracle BEA Weblogic — Linked ХSS vulnerability

Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: Bugs:Linked XSS Vulnerability Exploits:YES Reported:18.03.2009 Vendor response:19.03.2009 Description: XSS in Search Date of Public Advisory: 16.07.2009 Author: Alexandr Polyakov Description A linked XSS...

BEA (Oracle) WebLogic Server crossite scripting

Crossite scripting in administration console...

ACROS Security: HTML Injection in BEA (Oracle) WebLogic Server Console (ASPR #2009-01-27-1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2009-01-27-1 ------------------------------------------------------------------------- ASPR 2009-01-27-1: HTML Injection in BEA WebLogic Server Console...

Re: Assurent VR - Oracle BEA WebLogic Server Apache Connector Buffer Overflow

Hello Assurent & Oracle, On Tue, 13 Jan 2009, [email protected] wrote: : Oracle BEA WebLogic Server Apache Connector Buffer Overflow : : Reference: http://www.bea.com/weblogic/server/ : : 2. Vulnerability Summary : : A remotely exploitable vulnerability has been discovered in t...

Digital Security Research Group [DSecRG] Advisory #DSECRG-09-002

Digital Security Research Group DSecRG Advisory DSECRG-09-002 Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: http://oracle.com Bugs: Multiple XSS Vulnerabilities in samples Exploits: YES Reported: 16.07.2008 Vendor response: 18.07.2008 Last response:...