CVE-2008-0864

The CVE-2008-0864 entry concerns BEA WebLogic Portal 8.1 SP3–SP6, where the Admin Tools feature can inadvertently remove page entitlements when an administrator edits the page definition label. This could allow remote attackers to bypass intended access restrictions. The available connected docum...

CVE-2008-0896

BEA WebLogic Portal 10.0 and 9.2 through MP1 are affected. When an administrator deletes a single content portlet instance, entitlement policies for other content portlets are removed, allowing an attacker to bypass intended access restrictions. The available documents do not specify a patch or w...

CVE-2008-0868

Affected product: BEA WebLogic Portal (Groupspace) versions 10.0 and 9.2 up to Maintenance Pack 1. Issue: Cross-site scripting (XSS) vulnerability that could allow remote authenticated users to inject arbitrary web script or HTML via unknown vectors. Root cause details are not provided in the ava...

CVE-2008-0865

BEA WebLogic Portal 8.1 through SP6 contains an unspecified vulnerability that allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors. The available records do not specify the root cause, affected subcomponents, or a concrete exploit method. Th...

CVE-2008-0870

Bea WebLogic Portal 10.0 and 9.2 up to Maintenance Pack 2 has a vulnerability that can redirect the Portal Administration Console from HTTPS to HTTP, enabling remote attackers to sniff sessions. This is documented in CVE-2008-0870 with a CVSS v2 base score of 7.5 ( HIGH ) and network attack vecto...