Search criteria
447 vulnerabilities found for weblogic_server by bea
FKIE_CVE-2010-2375
Vulnerability from fkie_nvd - Published: 2010-07-13 22:30 - Updated: 2025-04-11 00:51
Severity ?
Summary
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea_systems | weblogic_server | 10.0 | |
| oracle | weblogic_server | 10.3.2.0.0 | |
| oracle | weblogic_server | 10.3.3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp3:*:*:*:*:*:*",
"matchCriteriaId": "73264312-A7AE-4974-A46D-70D8336A0B5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0:mp2:*:*:*:*:*:*",
"matchCriteriaId": "ADF4D7FE-55C5-4CBA-B75E-5A30E73AF402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:10.3.2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58B1DD57-050A-4A82-9E73-0C29DC22B581",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:10.3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "30D1EC44-6231-4710-B9FB-7551781814EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
},
{
"lang": "es",
"value": "Paquete/Privilegio: Plugins para Apache, Sun y servicios web IIS, vulnerabilidad no especificada en el componente WebLogic Server de Oracle Fusion Middleware v7.0 SP7, v8.1 SP6, v9.0, v9.1, v9.2 MP3, v10.0 MP2, v10.3.2 y v10.3.3, permite a atacantes remotos afectar la confidencialidad e integridad, relacionado con IIS."
}
],
"id": "CVE-2010-2375",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-07-13T22:30:02.547",
"references": [
{
"source": "secalert_us@oracle.com",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"sourceIdentifier": "secalert_us@oracle.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-3257
Vulnerability from fkie_nvd - Published: 2008-07-22 16:41 - Updated: 2025-04-09 00:30
Severity ?
Summary
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3FED57A9-CD22-48C6-AF7B-C361CA843283",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6E3A5C91-82C4-40B6-B8F2-C083AEF76723",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9500F620-FEFE-4CB7-A733-65E7372BD8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "76738B84-33DD-450B-90A2-B22B77D52857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:sp15:*:*:*:*:*:*",
"matchCriteriaId": "E951CB37-0BFA-48D3-A7FA-8B75A5FD7EB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "ABEA67C2-6CD7-49FB-9C18-B23045D272AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:sp1:*:*:*:*:*:*",
"matchCriteriaId": "F9EB3890-9D1F-4F5D-A124-ED109AD0669E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:sp2:*:*:*:*:*:*",
"matchCriteriaId": "77DF4FDA-D9FC-4B20-89BC-EF9D853644E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*",
"matchCriteriaId": "B2B4C4E8-2862-457F-BDCC-3F54B8F7AADE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*",
"matchCriteriaId": "47974FFB-1B28-492B-9A83-78AF16CF62CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*",
"matchCriteriaId": "6F27425D-1754-44AE-A4B5-F27D5FA6A052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*",
"matchCriteriaId": "034C62E6-3598-4D66-A0BD-8BD2E67048C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "EF96A26E-7284-43A0-BD6A-907E1029197D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "C8479B6C-464F-41BC-BF81-31EA74CEF4D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*",
"matchCriteriaId": "B08241CF-0F3D-44E2-8D72-4F98413933EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "703482E8-35A9-4A9F-A9FD-B0F8CEA4A404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "2B2BD55C-15DE-4D7B-9B5A-21016B7E2A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:apache_connector_in_weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6471A8E2-13B4-4506-89D0-86526394FD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "40A16573-91F2-42AA-8201-AE2D5962C4E6",
"versionEndIncluding": "10.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
},
{
"lang": "es",
"value": "Desbordamiento de b\u00fafer basado en pila en Apache Connector (mod_wl) en Oracle WebLogic Server (anteriormente BEA Weblogic Server) 10.3 y anteriores, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una cadena larga HTTP, como se ha demostrado mediante una cadena despu\u00e9s del \"POST /.jsp\" en una petici\u00f3n HTTP. NOTA: es probable que esta vulnerabilidad se solape con el CVE-2008-2579 u otra vulnerabilidad revelada en los avisos de Oracle CPUJul2008."
}
],
"id": "CVE-2008-3257",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-07-22T16:41:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31146"
},
{
"source": "cve@mitre.org",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"source": "cve@mitre.org",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"source": "cve@mitre.org",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/6089"
}
],
"sourceIdentifier": "cve@mitre.org",
"vendorComments": [
{
"comment": "Oracle has released a workaround for CVE-2008-3257. Information is available at:\n\nhttp://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html",
"lastModified": "2008-07-31T00:00:00",
"organization": "Oracle"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0897
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en BEA WebLogic Server de 9.0 a 10.0 permite a usuarios autentificados remotamente sin los permisos \"receive (recibir)\" evitar las restricciones de acceso previstas y recibir mensajes de un JMS Topic independiente o un destino de miembro Distributed Topic seguro, relacionados a subscripciones duraderas."
}
],
"id": "CVE-2008-0897",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0895
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLogic Express de 6.1 a 10.0 permite a atacantes remotos evitar la autentificaci\u00f3n para servlets de aplicaci\u00f3n a trav\u00e9s de cabeceras de petici\u00f3n modificadas."
}
],
"id": "CVE-2008-0895",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019443"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019443"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0899
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la Administration Console de BEA WebLogic Server y Express de 9.0 a 10.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de URLs modificados que no se manipulan correctamente por Unexpected Exception Page (Excepci\u00f3n de P\u00e1gina no Esperada)."
}
],
"id": "CVE-2008-0899",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0901
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_server | 10.0_mp1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
},
{
"lang": "es",
"value": "BEA WebLogic Server y Express de 7.0 a 10.0 permite a atacantes remotos llevar a cabo ataques para adivinar contrase\u00f1as mediante fuerza bruta, incluso cuando se ha activado el cierre de cuenta, a trav\u00e9s de URLs manipulados que indican si la contrase\u00f1a supuesta es buena o no."
}
],
"id": "CVE-2008-0901",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0898
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
},
{
"lang": "es",
"value": "La caracter\u00edstica de cola distribuida en JMS de BEA WebLogic Server de 9.0 a 10.0, en ciertas configuraciones, no manipula correctamente cuando un cliente no puede enviar un mensaje a un miembro de una cola distribuida, lo que permite a usuarios autentificados remotamente evitar las restricciones de acceso previstas para colas distribuidas protegidas."
}
],
"id": "CVE-2008-0898",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0902
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_server | 10.0_mp1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Server y Express de 6.1 a 10.0 MP1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de muestras no especificadas. NOTA: podr\u00eda ser la misma vulnerabilidad que CVE-2007-2694."
}
],
"id": "CVE-2008-0902",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0900
Vulnerability from fkie_nvd - Published: 2008-02-22 21:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_express | 9.2 | |
| bea_systems | weblogic_express | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "715D1DD4-A736-4F55-9369-71C232AB14CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_express:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "FF045092-39D3-4598-99DA-D1B35F0DDC3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_express:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61231482-5CC5-4C23-AA48-11E24FB6C94F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en BEA WebLogic Server y Express de 8.1 SP4 a SP6, de 9.2 a MP1 y 10.0 permite a usuarios autentificados remotamente secuestrar sesiones web a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2008-0900",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0863
Vulnerability from fkie_nvd - Published: 2008-02-21 01:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLogic Express 9.0 y 9.1 muestra el servicio web WSDL y pol\u00edticas de seguridad, esto permite a atacantes remotos obtener informaci\u00f3n sensible y potencialmente lanzar ataques adicionales."
}
],
"id": "CVE-2008-0863",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-21T01:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-0869
Vulnerability from fkie_nvd - Published: 2008-02-21 01:44 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea_systems | weblogic | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "AD6F9694-259F-4631-BC93-B1136F08E77E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "77624161-7740-4162-9C83-C0DFEA2BBCCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "E785D039-3426-4C1F-BBA8-7C6D32FB141E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "D4B2A474-B6C4-47B6-8B20-8722A8C25238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "2FDBD7AF-51AC-48B9-A465-0C13B9230EE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "66DD06E2-B659-4927-9DEA-8B88CA56D75D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a \"framework defined request parameter\" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Workshop de 8.1 a SP6 y Workshop para WebLogic de 9.0 a 10.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un \"par\u00e1metro de petici\u00f3n de marco de trabajo definido\" cuando se utiliza WebLogic Workshop o el marco de trabajo Apache Beehive NetUI con flujos de p\u00e1gina."
}
],
"id": "CVE-2008-0869",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-21T01:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019438"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0611"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019438"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2010-2375 (GCVE-0-2010-2375)
Vulnerability from cvelistv5 – Published: 2010-07-13 22:07 – Updated: 2024-08-07 02:32
VLAI?
Summary
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.381Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-10-23T09:00:00",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert_us@oracle.com",
"ID": "CVE-2010-2375",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2010-2375",
"datePublished": "2010-07-13T22:07:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3257 (GCVE-0-2008-3257)
Vulnerability from cvelistv5 – Published: 2008-07-22 16:00 – Updated: 2024-08-07 09:28
VLAI?
Summary
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:41.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3257",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"name": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"name": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html",
"refsource": "CONFIRM",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"name": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html",
"refsource": "CONFIRM",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3257",
"datePublished": "2008-07-22T16:00:00",
"dateReserved": "2008-07-22T00:00:00",
"dateUpdated": "2024-08-07T09:28:41.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0902 (GCVE-0-2008-0902)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.105Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-80.04",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0902",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0898 (GCVE-0-2008-0898)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0898",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019447",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0898",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0899 (GCVE-0-2008-0899)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0899",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019448",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0899",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0897 (GCVE-0-2008-0897)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:39.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0897",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-193.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0897",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0895 (GCVE-0-2008-0895)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.067Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0895",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019443"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0895",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0901 (GCVE-0-2008-0901)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.056Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0901",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-197.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "http://www.s21sec.com/avisos/s21sec-040-en.txt",
"refsource": "MISC",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0901",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0900 (GCVE-0-2008-0900)
Vulnerability from cvelistv5 – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.091Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019439",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0900",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0863 (GCVE-0-2008-0863)
Vulnerability from cvelistv5 – Published: 2008-02-21 01:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.101Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019455",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019455",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0863",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019455",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0863",
"datePublished": "2008-02-21T01:00:00",
"dateReserved": "2008-02-20T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2375 (GCVE-0-2010-2375)
Vulnerability from nvd – Published: 2010-07-13 22:07 – Updated: 2024-08-07 02:32
VLAI?
Summary
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.381Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-10-23T09:00:00",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert_us@oracle.com",
"ID": "CVE-2010-2375",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2010-2375",
"datePublished": "2010-07-13T22:07:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3257 (GCVE-0-2008-3257)
Vulnerability from nvd – Published: 2008-07-22 16:00 – Updated: 2024-08-07 09:28
VLAI?
Summary
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:41.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3257",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"name": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"name": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html",
"refsource": "CONFIRM",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"name": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html",
"refsource": "CONFIRM",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3257",
"datePublished": "2008-07-22T16:00:00",
"dateReserved": "2008-07-22T00:00:00",
"dateUpdated": "2024-08-07T09:28:41.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0902 (GCVE-0-2008-0902)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.105Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-80.04",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0902",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0898 (GCVE-0-2008-0898)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0898",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019447",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0898",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0899 (GCVE-0-2008-0899)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0899",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019448",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0899",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0897 (GCVE-0-2008-0897)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:39.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0897",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-193.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0897",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0895 (GCVE-0-2008-0895)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.067Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0895",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019443"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0895",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0901 (GCVE-0-2008-0901)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.056Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0901",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-197.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "http://www.s21sec.com/avisos/s21sec-040-en.txt",
"refsource": "MISC",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0901",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-0900 (GCVE-0-2008-0900)
Vulnerability from nvd – Published: 2008-02-22 21:00 – Updated: 2024-08-07 08:01
VLAI?
Summary
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.091Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019439",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0900",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}