CVE-2008-0866

CVE-2008-0866 affects BEA WebLogic Workshop (via NetUI page flows) and is caused by cross-site scripting vulnerabilities where an invalid action URI is not properly handled, enabling injection of arbitrary script/HTML. The NVD entry documents the weakness and its CVSS v2 base score of 4.3 (Medium...

CVE-2008-0864

Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions...

CVE-2008-0868

Affected product: BEA WebLogic Portal (Groupspace) versions 10.0 and 9.2 up to Maintenance Pack 1. Issue: Cross-site scripting (XSS) vulnerability that could allow remote authenticated users to inject arbitrary web script or HTML via unknown vectors. Root cause details are not provided in the ava...

CVE-2008-0865

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors...

CVE-2008-0863

BEA WebLogic Server and WebLogic Express 9.0/9.1 expose the web service WSDL and security policies, allowing remote retrieval of sensitive information and the potential to launch further attacks. Affected component: WebLogic web services configuration; root cause: exposed WSDL/security policy end...

CVE-2008-0865

BEA WebLogic Portal 8.1 through SP6 contains an unspecified vulnerability that allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors. The available records do not specify the root cause, affected subcomponents, or a concrete exploit method. Th...

CVE-2008-0870

Bea WebLogic Portal 10.0 and 9.2 up to Maintenance Pack 2 has a vulnerability that can redirect the Portal Administration Console from HTTPS to HTTP, enabling remote attackers to sniff sessions. This is documented in CVE-2008-0870 with a CVSS v2 base score of 7.5 ( HIGH ) and network attack vecto...

CVE-2008-0869

CVE-2008-0869 describes a cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 (SP6) and Workshop for WebLogic 9.0–10.0. The issue allows remote attackers to inject arbitrary web script/HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehiv...

CVE-2008-0868

Cross-site scripting XSS vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-0867

Cross-site scripting XSS vulnerability in portal/server.pt in BEA AquaLogic Interaction 6.1 through MP1 and Plumtree Foundation 6.0 through SP1 allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2008-0866

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject arbitrary web script or HTML via an invalid action URI, which is not properly handled by NetUI page flows...

CVE-2008-0870

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session...

CVE-2008-0869

Cross-site scripting XSS vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with...

CVE-2008-0867

BEA AquaLogic Interaction 6.1 MP1 and Plumtree Foundation 6.0 SP1 are affected by CVE-2008-0867, a Cross‑Site Scripting (XSS) flaw in portal/server.pt that allows injection of arbitrary web script or HTML via the name parameter. The vulnerability arises from handling user-supplied input in the po...

BEA WebLogic Server Multiple Vulnerabilities

Binary data 4383.prm...

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals Description: BEA Plumtree Foundation portal 6.0 and BEA AquaLogic Interaction 6.1 are vulnerable to a XSS vulnerability affecting the 'name' parameter which is submitted to the '/portal/server.pt' server-side script. Date...

BEA Plumtree portal/server.pt name Parameter XSS

The version of the Plumtree portal included with BEA AquaLogic Interaction / Plumtree Foundation and installed on the remote host fails to sanitize user-supplied input to the 'name' parameter of the 'portal/server.pt' script before using it to generate dynamic HTML output. An unauthenticated...

CVE-2007-6384

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...

CVE-2007-6384

Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...