2969 matches found
CVE-2008-2581
Unspecified vulnerability in the WebLogic Server component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 has unknown impact and remote attack vectors related to UDDI Explorer...
CVE-2008-2577
CVE-2008-2577 is an unspecified privilege-escalation issue in Oracle BEA WebLogic Server 9.2 MP1. Connected sources identify the vulnerability as affecting the WebLogic Console and WLST component, with the BEA/Oracle WebLogic Server entry listing “Console or WLST user” as the affected vector and ...
CVE-2008-2576
CVE-2008-2576 affects Oracle WebLogic Server (BEA Product Suite) 8.1 SP6 and 9.x line (9.0–9.2). The connected data describe a local vulnerability in WebLogic Server with unspecified impact; one Nessus entry characterizes a ForeignJMS-related information disclosure that requires authentication. T...
PT-2008-4033 · Oracle · Oracle Weblogic Server
Name of the Vulnerable Software and Affected Versions: Oracle BEA Product Suite versions 9.2 MP1 and 10.0 Description: The issue concerns an unspecified vulnerability in the WebLogic Server component, with unknown impact and local attack vectors. There is no information provided about the estimat...
PT-2008-4032 · Oracle · Oracle Weblogic Server
Name of the Vulnerable Software and Affected Versions: Oracle BEA Product Suite version 9.2 MP1 Description: The issue concerns an unspecified vulnerability in the WebLogic Server component. It has unknown impact and can be exploited through remote authenticated attack vectors. Recommendations: F...
ACROS Security: Session Fixation Vulnerability in WebLogic Administration Console (#2008-03-11-2)
=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2008-03-11-2 ------------------------------------------------------------------------- ASPR 2008-03-11-2: Session Fixation Vulnerability in WebLogic...
ACROS Security: HTML Injection in BEA WebLogic Server Console (ASPR #2008-03-11-1)
=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2008-03-11-1 ------------------------------------------------------------------------- ASPR 2008-03-11-1: HTML Injection in BEA WebLogic Server Console...
BEA WebLogic Server account locking bypass
It's possible to bruteforce username/password of locked account...
Default credentials
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not...
CVE-2008-0901
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not...
CVE-2008-0898
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected...
CVE-2008-0902
Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694...
Code injection
Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service web server crash via a crafted URL...
Cross site scripting
Cross-site scripting XSS vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page...
CVE-2008-0897
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptio...
Design/Logic Flaw
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptio...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694...
Design/Logic Flaw
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected...