CVE-2007-2696

The vulnerability CVE-2007-2696 affects BEA WebLogic Server JMS Server (versions 6.1 SP7 and earlier, 7.0 SP6 and earlier, 8.1 SP5 and earlier). The JMS Server’s front-end access policy enforcement can be bypassed, allowing remote attackers to access protected JMS queues by sending direct request...

CVE-2007-2703

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources...

CVE-2007-2702

Cross-site scripting XSS vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2694

CVE-2007-2694 concerns multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server. Affected products span BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA. The root cause is improper handli...

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information...

CVE-2007-2700

The vulnerability CVE-2007-2700 affects BEA WebLogic Express and WebLogic Server (versions 9.0 and 9.1). The WLST script generated by configToScript does not encrypt certain attributes in configuration files when creating a new domain, enabling remote authenticated users to obtain sensitive infor...

CVE-2007-2694

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-2701

Technical details about CVE-2007-2701 are not publicly provided in the supplied documents. No concrete affected products, versions, or remediations are confirmed here. Monitor for updates as new information may emerge.

CVE-2007-2698

Summary: CVE-2007-2698 affects BEA WebLogic Server 9.0 Administr ation Console. The issue allows an attacker to view plaintext Web Service attributes during configuration creation, potentially exposing sensitive credentials. The published CVSS v2 base score is 5.0 (Medium): Network access, low at...

CVE-2007-2701

The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected...

CVE-2007-2698

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...

BEA WebLogic / AquaLogic multiple security vulnerabilities

No description provided...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

CVE-2007-0432

BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities...

Authentication flaw

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...

CVE-2007-0433

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...

Authorization

BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities...

Design/Logic Flaw

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

CVE-2007-0433

BEA AquaLogic Enterprise Security 2.0–2.0 SP2, 2.1–2.1 SP1, and 2.2 using Active Directory LDAP for authentication is vulnerable: remote authenticated users can access the server even after the account is disabled. Root cause/technical specifics beyond this description are not provided in the sup...