3576 matches found
CVE-2002-1030: Undefined Security Weakness
Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...
BEA WebLogic Server fails to discard cached authentication information when web applications are updated
Overview The BEA WebLogic server contains a vulnerability that may allow authenticated users to bypass authentication for a given web application when the application has been updated. Description The BEA WebLogic Server provides a feature that allows it to store user authentication information f...
CVE-2003-0151
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...
CVE-2003-0151
CVE-2003-0151 affects BEA WebLogic Server and Express versions 6.0–7.0. The vulnerability is an access-control flaw in internal admin servlets that may allow remote attackers to read arbitrary files or execute arbitrary code. The connected sources confirm the affected products and the nature of t...
CVE-2003-0151
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...
CVE-2003-0151: Undefined Security Weakness
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code...
CVE-2003-1095
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...
SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express
Remote Administration of BEA WebLogic Server and Express Release Date: March 18, 2003 Severity: High Systems Affected: • WebLogic Server and Express 6.0 • WebLogic Server and Express 6.1 • WebLogic Server and Express 7.0 Description: SPI Labs and S21sec have identified a serious vulnerability tha...
S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server
ID: S21SEC-011-en Title: Multiple vulnerabilities in BEA WebLogic Server Date: 7/01/2003 Status: Patch published Scope: Remote command execution Platforms: Linux, Windows 2000, probably others Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-011-en.txt Release: Public S 2 1 S E C...
BEA WebLogic Server "ResourceAllocationException" exception may disclose user password
Overview A vulnerability in BEA's WebLogic Server may disclose sensitive information. Description From the BEA WebLogic Server 7.0 Overview:BEA WebLogic Server is a fully featured, standards-based application server providing the foundation on which an enterprise can build its applications. BEA...
CVE-2002-2142
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper...
CVE-2002-2141
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans EJB on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow...
CVE-2002-2177
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users...
CVE-2002-1030
Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service crash via a flood of data and connections...
KPMG-2002029: Bea Weblogic Performance Pack Denial of Service
-------------------------------------------------------------------- Title: Bea Weblogic Performance Pack Denial of Service BUG-ID: 2002029 Released: 8th Jul 2002 -------------------------------------------------------------------- Problem: ======== If the performance pack is enabled, the Bea...
BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service
source: https://www.securityfocus.com/bid/4646/info BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions. BEA WebLogic Express provides a platform for serving dynamic data to web and wireless application...
BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service
BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service source: https://www.securityfocus.com/bid/4646/info BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions. BEA WebLogic Expre...
CVE-2002-0106
BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name...
CVE-2002-0106
BEA Systems WebLogic Server 6.1 is affected. The vulnerability allows remote attackers to cause a denial of service by sending a sequence of requests to JSP files that contain an MS-DOS device name. The available documents describe the impact as a DoS but do not provide an exploit vector, affecte...