BEA WebLogic Server and Express 7.x Passwords Disclosure

------------------------------------------------------------ BEA WebLogic Server and Express 7.x Passwords Disclosure ------------------------------------------------------------ Affected Versions ----------------- BEA WebLogic Server 7.x BEA WebLogic Express 7.x ADVISORY -------- This...

BEA WebLogic SSIServlet Invocation Source Code Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by prefixing the path to the .jsp files by /.shtml/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script is based on BEAweblogicRevealsourcecode.nasl Script audit and contributions from Carmichael Security Erik...

CVE-2002-1030

Technical details (affected components, root cause, impact, remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2002-1030

Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...

BEA WebLogic 7.0 - HostnameNetBIOS Name Remote Information Disclosure

BEA WebLogic 7.0 - HostnameNetBIOS Name Remote Information Disclosure source: https://www.securityfocus.com/bid/7257/info It has been reported that some types of requests may result in sensitive information disclosure. From this, an attacker may be able to launch a more organized attack against...

BEA WebLogic 7.0 - Hostname/NetBIOS Name Remote Information Disclosure

source: https://www.securityfocus.com/bid/7257/info It has been reported that some types of requests may result in sensitive information disclosure. From this, an attacker may be able to launch a more organized attack against vulnerable hosts. GET . HTTP/1.0\r\n\r\n And also: ./ .// .////////////...

BEA WebLogic Server fails to discard cached authentication information when web applications are updated

Overview The BEA WebLogic server contains a vulnerability that may allow authenticated users to bypass authentication for a given web application when the application has been updated. Description The BEA WebLogic Server provides a feature that allows it to store user authentication information f...

CVE-2003-0151

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...

CVE-2003-0151

CVE-2003-0151 affects BEA WebLogic Server and Express versions 6.0–7.0. The vulnerability is an access-control flaw in internal admin servlets that may allow remote attackers to read arbitrary files or execute arbitrary code. The connected sources confirm the affected products and the nature of t...

CVE-2003-0151

BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...

CVE-2003-1095

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...

Bea Weblogic multiple bugs

It's possible to download, upload and execute any file...

BEA WebLogic Server "ResourceAllocationException" exception may disclose user password

Overview A vulnerability in BEA's WebLogic Server may disclose sensitive information. Description From the BEA WebLogic Server 7.0 Overview:BEA WebLogic Server is a fully featured, standards-based application server providing the foundation on which an enterprise can build its applications. BEA...

CVE-2002-2141

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...

CVE-2002-2177

BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...

CVE-2002-1030

Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...

Connection flood DoS against BEA Weblogic

If Performance Pack installed server crashes on connection flood...

KPMG-2002029: Bea Weblogic Performance Pack Denial of Service

-------------------------------------------------------------------- Title: Bea Weblogic Performance Pack Denial of Service BUG-ID: 2002029 Released: 8th Jul 2002 -------------------------------------------------------------------- Problem: ======== If the performance pack is enabled, the Bea...

KPMG-2002016: Bea Weblogic incorrect URL parsing issues

-------------------------------------------------------------------- Title: Bea Weblogic incorrect URL parsing issues BUG-ID: 2002016 Released: 30th Apr 2002 -------------------------------------------------------------------- Problem: ======== The Bea Weblogic server incorrectly parses certain...

BEA WebLogic Null Byte Request JSP Source Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by adding an encoded character %00x at the end of the request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison and is based on BEAweblogicRevealsourcecode.nasl Script audit an...