Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
BeaWeblogic Server

9 matches found

CVE
CVE•added 2007/05/16 1:19 a.m.•91 views

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.

7.1CVSS6.8AI score0.01118EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•45 views

CVE-2007-2700

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.

4CVSS6.1AI score0.00401EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•43 views

CVE-2007-2695

The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrativ...

5.1CVSS6.8AI score0.02035EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•43 views

CVE-2007-2696

The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.

6.8CVSS6.8AI score0.01255EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•41 views

CVE-2007-2694

Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.7AI score0.00377EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•39 views

CVE-2007-2698

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.

5CVSS6.5AI score0.00315EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•36 views

CVE-2007-2701

The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue...

4.6CVSS6.7AI score0.00483EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•36 views

CVE-2007-2704

BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.

5.4CVSS6.7AI score0.00866EPSS
CVE
CVE•added 2007/05/16 1:19 a.m.•35 views

CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administr...

5.1CVSS6.9AI score0.01171EPSS