CVE-2007-0417

BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity...

CVE-2007-0417

BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity...

CVE-2007-0417

BEA WebLogic Server has a vulnerability (CVE-2007-0417) affecting versions 7.0–7.0 SP7, 8.1–8.1 SP5, 9.0, and 9.1 when using the WebLogic Server 6.1 compatibility realm. According to the description, this allows attackers to execute certain EJB container persistence operations with an administrat...

CVE-2007-0418

CVE-2007-0418 affects BEA WebLogic Server 7.0–7.0 SP6, 8.1–8.1 SP5, 9.0, and 9.1. The root cause is that the security policy does not declare permissions for EJB methods with array parameters, enabling remote attackers to obtain unauthorized access to these methods. Affects multiple versions; exp...

BEA产品多个远程安全漏洞

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Weblogic中存在多个安全漏洞，可能允许恶意攻击者获得敏感信息、绕过某些安全限制、导致拒绝服务或完全入侵系统。 这些漏洞包括： 1 SSL库中的漏洞可能允许判断明文块； 2 从缓存重用连接时服务器没有正确地验证客户端证书，导致攻击者可以通过X.509证书访问Web服务器。成功攻击要求应用程序允许通过单个客户端进程访问多个用户； 3 存储在JDBCDataSourceFactory MBean Properties属性中的口令没有加密； 4...

Code injection

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2006-2432

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2006-2432

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2006-2432

CVE-2006-2432 affects IBM WebSphere Application Server 5.0.2 (and earlier cumulative fixes) and 5.1.1 (and earlier cumulative fixes); on Solaris, a crafted LTPA token enables EJB access. The NVD entry assigns a CVSSv2 base score of 7.5 (HIGH) with network attack vector, low attack complexity, and...

CVE-2005-4709

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans EJB 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an...

CVE-2005-4709

The CVE concerns JBoss EJB 3.0 RC3. The popSubjectContext method in SecurityAssociation preserves threadPrincipal and threadCredential from a prior client after the session ends, enabling a remote attacker to assume the roles of that previous client on the same server thread. This is described as...

CVE-2006-0427

Vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords by accessing restricted functionality. Affects BEA WebLogic products with limited confidentiality impact (partial). Exploit details, root cau...

CVE-2005-4709

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans EJB 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an...

CVE-2004-0713

The CVE-2004-0713 case affects BEA WebLogic Server and WebLogic Express, versions 8.1–SP2, 7.0–SP4, and 6.1–SP6. The vulnerability is in the remove method of a stateful Enterprise JavaBean (EJB), where EJB permissions are not properly checked before unexporting a bean. This allows remote authenti...

CVE-2004-0713

The remove method in a stateful Enterprise JavaBean EJB in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from...

BEA WebLogic Server allows unauthorized removal of EJB objects

Overview There is a vulnerability in the BEA WebLogic Server that could allow the unauthorized removal of an Enterprise JavaBean EJB. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...