CVE-2004-2424

This CVE concerns BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2. A vulnerability in HTTPS session handling allows remote attackers to cause a denial of service by consuming network ports, with the server failing to release ports after a session ends. The vulnerability is described ...

CVE-2004-2424

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

CVE-2004-2424: Undefined Security Weakness

BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service network port consumption via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends...

CVE-2003-1221

The CVE concerns BEA WebLogic Express and WebLogic Server versions 7.0–8.1 SP 1. In certain configurations, a request to use T3 over SSL (t3s) sent to the insecure T3 port could cause a non-SSL connection to be used for the communication, allowing session sniffing. The connected sources (NVD/CVE ...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2004-2321

BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including 1 ServerStartMBean.Password and 2 NodeManagerMBean.CertificatePassword...

CVE-2003-1224

BEA WebLogic Server/Express 7.0 and 7.0.0.1 are affected by CVE-2003-1224 due to a bug in the JDBCConnectionPoolRuntimeMBean where the password is displayed on screen in cleartext. This allows local observers to read a user’s password via shoulder surfing. The vulnerability is classified with a l...

CVE-2004-2320

Technical details for CVE-2004-2320 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2003-1224

Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing "shoulder surfing" the screen...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2004-2321

Affected products: BEA WebLogic Server and Express 8.1 SP1 and earlier. Vulnerability: local users in the Operator role can obtain administrator passwords via MBean attributes (ServerStartMBean.Password; NodeManagerMBean.CertificatePassword). Impact: partial confidentiality exposure; access is LO...

CVE-2003-1225

The vulnerability CVE-2003-1225 affects BEA WebLogic Server and Express 7.0 and 7.0.0.1, where the default CredentialMapper stores passwords in cleartext on disk, enabling local users to extract passwords. The related Nessus entry corroborates a local-access information disclosure risk, including...

CVE-2003-1226

BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords...

CVE-2003-1220

BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service proxy plugin crash via a malformed URL...

CVE-2003-1225

The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords...

CVE-2003-1220: Undefined Security Weakness

BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service proxy plugin crash via a malformed URL...

CVE-2003-1224: Undefined Security Weakness

Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing "shoulder surfing" the screen...

CVE-2003-1222: Undefined Security Weakness

BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service JMS provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password...

CVE-2004-2321: Undefined Security Weakness

BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including 1 ServerStartMBean.Password and 2 NodeManagerMBean.CertificatePassword...

CVE-2003-1223: Undefined Security Weakness

The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service Node Manager crash via malformed data to the Node Manager's port, as demonstrated by nmap...