CVE-2007-2701

The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected...

Design/Logic Flaw

The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server...

Cross site scripting

Cross-site scripting XSS vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-2704

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service SSL port unavailability by accessing a half-closed SSL socket...

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources...

Hardcoded credentials

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access...

CVE-2007-2694

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2702

Cross-site scripting XSS vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor...

Design/Logic Flaw

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service SSL port unavailability by accessing a half-closed SSL socket...

Information disclosure

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2694

CVE-2007-2694 concerns multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server. Affected products span BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA. The root cause is improper handli...

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2704

CVE-2007-2704 affects BEA WebLogic Server 9.0–9.2. A remote attacker can cause a denial of service by connecting to a half‑closed SSL socket, leading to SSL port unavailability. The available sources confirm the vulnerability exists in these WebLogic versions and describe the remote DoS impact vi...

CVE-2007-2699

The CVE-2007-2699 entry concerns BEA WebLogic Express/Server 9.0/9.1 where the Administration Console fails to enforce Domain Security Policies, allowing remote administrative users in the Deployer role to upload arbitrary files. The connected documents indicate an abuse scenario via the WebLogic...

CVE-2007-2705

The CVE-2007-2705 entry describes a directory-traversal vulnerability in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, triggered when deployed in an exploded format. The issue resides in the Test View Console and allows remote attackers to list a WebLogic Work...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA is affected by CVE-2007-2703. A long role description can corrupt a visitor entitlements role, which might allow remote authenticated users to access privileged resources. The connected records corroborate the same vulnerability description across NVD and related feeds,...