CVE-2004-2320

Technical details for CVE-2004-2320 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2008-3257

CVE-2008-3257 describes a stack-based buffer overflow in the Oracle WebLogic Server Apache Connector (mod_wl) that affects WebLogic Server 10.3 and earlier. The overflow occurs when handling a long HTTP version string in a POST request, allowing remote attackers to potentially execute arbitrary c...

CVE-2010-2375

Oracle WebLogic Server Plug-in HTTP Injection (CVE-2010-2375) affects the WebLogic web-server plugins for Apache, Sun, and IIS; the vulnerability arises because the plugin fails to sanitize certain URL-encoded headers before forwarding requests to WebLogic, enabling unauthenticated remote attacke...

CVE-2007-2699

The CVE-2007-2699 entry concerns BEA WebLogic Express/Server 9.0/9.1 where the Administration Console fails to enforce Domain Security Policies, allowing remote administrative users in the Deployer role to upload arbitrary files. The connected documents indicate an abuse scenario via the WebLogic...

CVE-2005-4749

CVE-2005-4749 describes an HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express. Affected products include WebLogic Server/Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The flaw allows remote attackers to inject arbitrary HTTP headers via u...

CVE-2004-0204

CVE-2004-0204 describes a directory traversal in Crystal Reports and Crystal Enterprise Web viewers redistributed with Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2. The vulnerability arises from improper validation of HTTP...

CVE-2000-0683

BEA WebLogic 5.1.x is affected by an information-disclosure vulnerability where remote attackers can read the source code of parsed JSP pages by injecting /*.shtml/ into the URL, which invokes the SSIServlet. The underlying cause is JSP/SSIServlet invocation that allows viewing source code, leadi...

CVE-2003-0640

BEA WebLogic Server and Express are affected when NodeManager is used to start servers. Operator users can overwrite usernames and passwords, which may enable escalation to Admin privileges. The available documents confirm this description but do not specify affected versions or concrete exploit ...

CVE-2000-0682

BEA WebLogic 5.1.x is affected by a source-code disclosure vulnerability: inserting /ConsoleHelp/ into a URL can cause the FileServlet to disclose source files. Multiple sources (NVD entry CVE-2000-0682 and OpenVAS/Nessus plugins) describe this WebLogic FileServlet source code disclosure issue. T...

CVE-2007-4618

CVE-2007-4618 affects BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7. The issue is an unspecified vulnerability that allows remote attackers to cause a denial of service via certain malformed HTTP headers, leading to disk consumption. The provided documents do not include expli...

CVE-2007-0413

CVE-2007-0413 - MODE C BEA WebLogic Server versions 8.1 through 8.1 SP5 store cleartext data in a backup of config.xml after offline editing. This allows local users to obtain sensitive information by reading the backup file. The vulnerability is due to storing sensitive configuration data in an ...

CVE-2005-1744

The CVE concerns BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5, where a redeploy does not log out users. This allows continued access to the application without re-authentication, potentially violating newly changed security constraints or role mappings. The issue is documen...

CVE-2003-1094

Technical details for CVE-2003-1094 are not provided in the connected documents; only the BEA WebLogic 7.0 SP3 issue is described. Monitor for updates.

CVE-2005-1748

The CVE-2005-1748 issue affects BEA WebLogic Server and WebLogic Express, specifically the embedded LDAP server in versions 8.1 through Service Pack 4 and 7.0 through Service Pack 5. The root cause is the LDAP server allowing remote anonymous binds, which may enable remote attackers to view user ...

CVE-2000-0681

CVE-2000-0681 describes a buffer overflow in the BEA WebLogic Server proxy plug-in that handles third‑party web server requests to forward JSP URLs. The flaw, triggered by long URL paths (notably with a .JSP extension), can overflow a buffer in wl_proxy and allow remote code execution as the user...

CVE-2001-0098

WebLogic Server before 5.1.0 is affected by a buffer overflow in URL handling triggered by a long URL starting with "..". The CVE entry (CVE-2001-0098) is supported by OpenVAS references noting that requesting an overly long URL starting with a double dot can crash certain WebLogic versions and m...

CVE-2003-0622

CVE-2003-0622 affects BEA Tuxedo Admin Console (versions 8.1 and earlier). The vulnerability allows remote attackers to cause a denial of service (hang) by sending pathname arguments containing MS-DOS device names (e.g., CON, AUX). The provided documents confirm the affected product/version and t...

CVE-2005-1742

CVE-2005-1742 affects BEA WebLogic Server and WebLogic Express 8.1 SP2/SP3. The vulnerability allows users with the Monitor security role to shrink or reset JDBC connection pools, indicating an authorization/privilege misuse issue affecting pool configuration. The provided documents confirm the a...

CVE-2003-0621

CVE-2003-0621 affects the BEA Tuxedo Administration Console (8.1 and earlier). The vulnerability arises from the INIFILE argument, where modified paths can cause directory traversal to reveal files outside the web root. Impact is information disclosure; the description does not confirm exploit de...

CVE-2003-1095

BEA WebLogic Server/Express 7.0 and 7.0.0.1 are affected by CVE-2003-1095 due to improper handling of memory session persistence: authentication data is not cleared on redeploy, potentially allowing re-authenticated access without re-signing in. The issue is described across multiple feeds (NVD/N...

CVE-2003-1220

BEA WebLogic Server proxy plugin for BEA WebLogic Express and WebLogic Server 6.1–8.1 SP1 is affected by a DoS vulnerability where a malformed URL can crash the proxy plugin. Product/versions: BEA WebLogic Server proxy plugin for WebLogic Express and Server 6.1 through 8.1 SP1. Root cause: handli...

CVE-2003-1290

BEA WebLogic Server/Express 6.1, 7.0, 8.1 with RMI and anonymous admin lookup enabled is vulnerable to remote disclosure of configuration information via MBeanHome using JNDI. The issue stems from access to MBeanHome over JNDI that allows an attacker to obtain configuration details. Affected prod...

CVE-2005-4766

CVE-2005-4766 affects BEA WebLogic Server and WebLogic Express; versions 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic. The root cause is lack of encryption for multicast communications, which could allow an attacker to read sensitive cluster synchronization messa...

CVE-2006-1352

CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...

CVE-2007-2700

The vulnerability CVE-2007-2700 affects BEA WebLogic Express and WebLogic Server (versions 9.0 and 9.1). The WLST script generated by configToScript does not encrypt certain attributes in configuration files when creating a new domain, enabling remote authenticated users to obtain sensitive infor...

CVE-2007-4613

CVE-2007-4613 affects BEA WebLogic Server SSL libraries (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP5). Vulnerability: an attacker in a MITM can obtain plaintext from an SSL stream by injecting crafted data and measuring timing of error responses. This is a separate issue from CVE-2006-2461....

CVE-2002-2177

BEA WebLogic Server and Express 6.1–7.0.0.1 are affected by a vulnerability in how HTTP requests are buffered, which can cause the same response to be sent for two different requests. This could enable remote attackers to view information intended for other users. The issue is described across mu...

CVE-2005-1746

CVE-2005-1746 affects BEA WebLogic Server 7.0 up to Service Pack 5. The cluster cookie parsing code may contact any host/port specified in a cookie, even if not in the cluster, allowing remote attackers to cause a denial of service (cluster slowdown) via modified cookies. The provided sources do ...

CVE-2006-0421

CVE-2006-0421 affects BEA WebLogic Server and WebLogic Express 6.1 and 7.0. When multiple domains are created from a single WebLogic instance on the same machine, administrators of any domain can access other created domains, enabling privilege escalation within the same host. Public exploitation...

CVE-2006-0431

Technical details for CVE-2006-0431 are not publicly provided in the supplied documents. Monitor for updates from primary sources.

CVE-2007-2696

The vulnerability CVE-2007-2696 affects BEA WebLogic Server JMS Server (versions 6.1 SP7 and earlier, 7.0 SP6 and earlier, 8.1 SP5 and earlier). The JMS Server’s front-end access policy enforcement can be bypassed, allowing remote attackers to access protected JMS queues by sending direct request...

CVE-2003-1225

The vulnerability CVE-2003-1225 affects BEA WebLogic Server and Express 7.0 and 7.0.0.1, where the default CredentialMapper stores passwords in cleartext on disk, enabling local users to extract passwords. The related Nessus entry corroborates a local-access information disclosure risk, including...

CVE-2005-1380

BeA Admin Console 8.1 is affected by a cross-site scripting (XSS) vulnerability in the JndiFramesetAction path, allowing remote attackers to inject script via the server parameter. The issue is documented across multiple sources (CVE-2005-1380) with a CVSS v2 base score of 6.8 (MEDIUM) and networ...

CVE-2005-4759

CVE-2005-4759 affects BEA WebLogic Server and WebLogic Express 8.1 and 7.0. During OS platform migrations, it does not warn the admin about URLResource case-sensitivity differences, which may cause local users to inadvertently lose protection of Web Application pages. The NVD metrics show a base ...

CVE-2007-2694

CVE-2007-2694 concerns multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server. Affected products span BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA. The root cause is improper handli...

CVE-2007-2695

Technical details about CVE-2007-2695 are not publicly provided in the connected documents. Monitor official advisories for updates; current sources only repeat the vulnerability description without specifics on affected products, impact, or fixes.

CVE-2008-0900

CVE-2008-0900 affects BEA WebLogic Server and Express versions 8.1 SP4–SP6, 9.2 MP1, and 10.0. The root cause is a session fixation vulnerability that allows remote authenticated users to hijack web sessions via unknown vectors. Affected components are web session handling functions in these BEA ...

CVE-2003-0623

CVE-2003-0623 describes a cross-site scripting (XSS) vulnerability in the BEA Tuxedo Administration Console (versions 8.1 and earlier). The flaw allows remote attackers to inject arbitrary web script via the INIFILE parameter. The connected documents confirm the affected component and the exploit...

CVE-2003-0624

CVE-2003-0624 is an XSS vulnerability in BEA WebLogic’s InteractiveQuery.jsp (BEA WebLogic 8.1 and earlier). The flaw allows remote attackers to inject script via the person parameter. Public references (NVD, CVE listing, Full-Disclosure/Corsaire advisory) discuss the issue; a proof-of-concept UR...

CVE-2000-1238

The CVE-2000-1238 entry affects BEA Systems WebLogic Express and WebLogic Server 5.1 SP1–SP6. The issue allows remote attackers to bypass access controls for restricted JSP/servlet pages by using a URL that contains multiple forward slash characters before the restricted pages. Vulnerable compone...

CVE-2004-0712

BEA WebLogic Server 8.1 through SP2: The configuration tools (Unix config.sh and Windows config.cmd) create a log file that stores the administrative username and password in cleartext, enabling local privilege escalation. Affected component: WebLogic Server configuration tooling. Root cause: cre...

CVE-2005-1743

CVE-2005-1743 affects BEA WebLogic Server/Express versions 8.1 (SP3) and 7.0 (SP5). The root cause: when a security provider throws an exception, WebLogic may use an incorrect thread identity and may fail to audit security exceptions. Implications noted: potential partial impact on confidentialit...

CVE-2006-2468

Vulnerability details for CVE-2006-2468 show that BEA WebLogic Server Administration Console exposes the domain name in the login form for BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6. The underlying issue is information disclosure in the Console login interface, which can allow remote att...

CVE-2007-0412

BEA WebLogic Server versions 6.1–6.1 SP7, 7.0–7.0 SP7, and 8.1–8.1 SP5 allow remote attackers to read arbitrary files inside the class-path by crafting .ear or exploded .ear archives that use the manifest-class-path to point to utility JARs. Root cause is misinterpretation of manifest-class-path ...

CVE-2007-2698

Summary: CVE-2007-2698 affects BEA WebLogic Server 9.0 Administr ation Console. The issue allows an attacker to view plaintext Web Service attributes during configuration creation, potentially exposing sensitive credentials. The published CVSS v2 base score is 5.0 (Medium): Network access, low at...

CVE-2003-0151

CVE-2003-0151 affects BEA WebLogic Server and Express versions 6.0–7.0. The vulnerability is an access-control flaw in internal admin servlets that may allow remote attackers to read arbitrary files or execute arbitrary code. The connected sources confirm the affected products and the nature of t...

CVE-2003-1223

The CVE-2003-1223 issue affects BEA WebLogic Express and BEA WebLogic Server 6.1–8.1 SP 1. It allows remote attackers to cause a denial of service (Node Manager crash) by sending malformed data to the Node Manager port, as demonstrated by nmap. The available documents do not specify the exact roo...

CVE-2003-1226

The CVE-2003-1226 entry concerns BEA WebLogic Server and Express versions 7.0 and 7.0.0.1 where secrets used for password encryption are stored insecurely in config.xml, filerealm.properties, and weblogic-rar.xml. This storage flaw enables a local attacker to read those secrets and decrypt passwo...

CVE-2007-0418

CVE-2007-0418 affects BEA WebLogic Server 7.0–7.0 SP6, 8.1–8.1 SP5, 9.0, and 9.1. The root cause is that the security policy does not declare permissions for EJB methods with array parameters, enabling remote attackers to obtain unauthorized access to these methods. Affects multiple versions; exp...

CVE-2007-0419

The CVE-2007-0419 issue affects the BEA WebLogic Server proxy plug-in for the Apache HTTP Server (pre June 2006). The root cause is improper handling of protocol errors in the plug-in, which can allow remote attackers to cause a denial of service (server outage). The vulnerability description not...