CVE-2007-0409

BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password...

CVE-2007-0424

Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable,...

CVE-2007-0421

BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service disk consumption via requests containing malformed headers, which cause a large amount of data to be written to the server log...

CVE-2007-0422

BEA WebLogic Server 9.0/9.1/9.2 Gold running on Solaris 9 is affected by CVE-2007-0422, allowing remote attackers to trigger a denial of service (server inaccessibility) through manipulated socket connections. The available sources confirm the affected product family and version range and the DoS...

CVE-2007-0417

BEA WebLogic Server has a vulnerability (CVE-2007-0417) affecting versions 7.0–7.0 SP7, 8.1–8.1 SP5, 9.0, and 9.1 when using the WebLogic Server 6.1 compatibility realm. According to the description, this allows attackers to execute certain EJB container persistence operations with an administrat...

CVE-2007-0416

CVE-2007-0416 affects BEA WebLogic Server 9.0/9.1: the WSEE runtime (WS-Security runtime) does not verify credentials during decryption of client messages, enabling remote attackers to bypass application security. Exploitation details are not provided in the sources; CVSS base score is 7.5 (HIGH)...

CVE-2007-0410

BeA WebLogic vulnerability: Unspecified flaw in thread management when T3 authentication is used affects WebLogic 7.0–7.0 SP6, 8.1–8.1 SP5, 9.0, and 9.1. Remote attackers can trigger a denial of service (thread and system hang) via unspecified sequences of events. No concrete exploit details, imp...

CVE-2007-0426

BEA WebLogic Portal 9.2 in a WebLogic Server clustered environment has a vulnerability where entitlement policy changes made on a managed server while the Administrative Server is unavailable may not propagate correctly, potentially allowing bypass of intended restrictions. The issue affects the ...

CVE-2007-0411

CVE-2007-0411 affects BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold when WS-Security is enabled. The vulnerability is that the server does not properly validate certificates, enabling a remote attacker to perform a man-in-the-middle (MITM) attack. This is the explicit risk descr...

CVE-2007-0424

The CVE-2007-0424 entry concerns the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server, vulnerable before September 2006. The available description indicates an unspecified vulnerability that allows remote attackers to cause a denial of service by sending certain requests that trig...

CVE-2007-0423

CVE-2007-0423 affects BEA WebLogic Portal 9.2. The issue arises when an administrator deletes entitlements for a role, which reportedly causes other entitlements to be inadvertently affected; the impact is described as unknown. No concrete root cause, vulnerability vector, exploit details, or rem...

CVE-2007-0420

BEA WebLogic Server 9.0, 9.1, and 9.2 Gold are affected by a vulnerability in which remote attackers can obtain sensitive information through malformed HTTP requests that reveal data from prior requests. The issue centers on information disclosure and is scored as medium (CVSS base 5.0, Network a...

CVE-2007-0408

BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate...

CVE-2007-0417

BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity...

CVE-2007-0416

The WSEE runtime WS-Security runtime in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security...

CVE-2007-0412

BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files...

CVE-2007-0409

CVE-2007-0409 affects BEA WebLogic Server versions 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release. The issue is that passwords stored in the JDBCDataSourceFactory MBean Properties are not encrypted, allowing a local administrator to read cleartext passwords. The provided docume...

CVE-2007-0414

CVE-2007-0414 affects BEA WebLogic Server 6.1–SP7, 7.0–SP6, 8.1–SP5, and 9.0. Remote attackers can cause a denial of service (server hang) by sending requests that make muxer threads block when processing error pages. Root cause: muxer threads block during error-page processing. Impact is a parti...

CVE-2007-0413

CVE-2007-0413 - MODE C BEA WebLogic Server versions 8.1 through 8.1 SP5 store cleartext data in a backup of config.xml after offline editing. This allows local users to obtain sensitive information by reading the backup file. The vulnerability is due to storing sensitive configuration data in an ...

CVE-2007-0421

BEA WebLogic Server versions affected are 6.1 (6.1 SP7) and 7.0 (7.0 SP7). The vulnerability allows remote attackers to trigger a denial of service by sending requests with malformed headers that cause a large amount of data to be written to the server log. The root cause is tied to processing of...