Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
BeaWeblogic Server9.1

28 matches found

CVE
CVE•added 2008/07/22 4:41 p.m.•100 views

CVE-2008-3257

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

10CVSS7.4AI score0.71508EPSS
CVE
CVE•added 2010/07/13 10:30 p.m.•96 views

CVE-2010-2375

Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.

6.4CVSS6AI score0.1617EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•91 views

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.

7.1CVSS6.8AI score0.01118EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•45 views

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.

4CVSS6.1AI score0.00375EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•43 views

CVE-2007-2695

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrativ...

5.1CVSS6.8AI score0.01907EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•41 views

CVE-2007-2694

Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.7AI score0.00377EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•37 views

CVE-2007-0418

BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.

7.5CVSS6.7AI score0.00775EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•36 views

CVE-2007-0422

BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.

5CVSS6.7AI score0.01084EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•36 views

CVE-2007-2704

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.

5.4CVSS6.7AI score0.00866EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•36 views

CVE-2008-0901

BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.

7.1CVSS6.9AI score0.0074EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•35 views

CVE-2007-0420

BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.

5CVSS6.2AI score0.00508EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•35 views

CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administr...

5.1CVSS6.9AI score0.01185EPSS
CVE
CVE•added 2007/08/31 12:17 a.m.•35 views

CVE-2007-4614

BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426.

7.5CVSS6.6AI score0.0075EPSS
CVE
CVE•added 2008/02/21 1:44 a.m.•35 views

CVE-2008-0869

Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with...

4.3CVSS5.7AI score0.00329EPSS
CVE
CVE•added 2006/05/19 10:2 a.m.•34 views

CVE-2006-2472

Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys.

4.9CVSS6.5AI score0.00077EPSS
CVE
CVE•added 2007/08/31 12:17 a.m.•34 views

CVE-2007-4616

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communication...

6.4CVSS6.7AI score0.00859EPSS
CVE
CVE•added 2007/10/18 9:17 p.m.•34 views

CVE-2007-5576

BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.

6.8CVSS6.3AI score0.00602EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•33 views

CVE-2007-0416

The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.

7.5CVSS6.7AI score0.0051EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•33 views

CVE-2008-0898

The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected dist...

5.8CVSS6.3AI score0.00227EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•32 views

CVE-2007-0410

Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."

5CVSS6.9AI score0.02054EPSS
CVE
CVE•added 2007/08/31 12:17 a.m.•32 views

CVE-2007-4615

The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications.

6.4CVSS6.7AI score0.00722EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•31 views

CVE-2007-0411

BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.

6.8CVSS6.6AI score0.00517EPSS
CVE
CVE•added 2008/02/21 1:44 a.m.•31 views

CVE-2008-0863

BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.

5CVSS6.3AI score0.0026EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•31 views

CVE-2008-0899

Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.

4.3CVSS5.7AI score0.00285EPSS
CVE
CVE•added 2007/01/23 12:28 a.m.•30 views

CVE-2007-0417

BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.

10CVSS6.9AI score0.00785EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•30 views

CVE-2008-0897

Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions...

7.9CVSS6.3AI score0.00185EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•30 views

CVE-2008-0902

Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.

4.3CVSS5.8AI score0.00377EPSS
CVE
CVE•added 2008/02/22 9:44 p.m.•25 views

CVE-2008-0895

BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.

6.4CVSS7AI score0.00382EPSS