Vulnerabilites related to bea - weblogic_server
cve-2008-0869
Vulnerability from cvelistv5
Published
2008-02-21 01:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1019438 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/263 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://www.vupen.com/english/advisories/2008/0611 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:39.719Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019438",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019438"
},
{
"name": "BEA08-189.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2008-0611",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0611"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a \"framework defined request parameter\" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019438",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019438"
},
{
"name": "BEA08-189.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2008-0611",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0611"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a \"framework defined request parameter\" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019438",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019438"
},
{
"name": "BEA08-189.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2008-0611",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0611"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0869",
"datePublished": "2008-02-21T01:00:00",
"dateReserved": "2008-02-20T00:00:00",
"dateUpdated": "2024-08-07T08:01:39.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4755
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 17:15
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/145 | vendor-advisory, x_refsource_BEA | |
| http://dev2dev.bea.com/pub/advisory/150 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-91.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/145"
},
{
"name": "BEA05-96.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/150"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-91.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/145"
},
{
"name": "BEA05-96.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/150"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4755",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-91.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/145"
},
{
"name": "BEA05-96.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/150"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4755",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T17:15:20.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2700
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/233 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34288 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/36068 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.180Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-163.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/233"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-configtoscr-information-disclosure(34288)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34288"
},
{
"name": "36068",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36068"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-163.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/233"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-configtoscr-information-disclosure(34288)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34288"
},
{
"name": "36068",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36068"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2700",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-163.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/233"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-configtoscr-information-disclosure(34288)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34288"
},
{
"name": "36068",
"refsource": "OSVDB",
"url": "http://osvdb.org/36068"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2700",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2466
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/192 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26461 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1016100 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.529Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA06-130.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/192"
},
{
"name": "weblogic-jsp-error-source-disclosure(26461)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26461"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016100",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016100"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a \"timing window\" when a compilation error occurs, aka the \"JSP showcode vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA06-130.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/192"
},
{
"name": "weblogic-jsp-error-source-disclosure(26461)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26461"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016100",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016100"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2466",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a \"timing window\" when a compilation error occurs, aka the \"JSP showcode vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA06-130.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/192"
},
{
"name": "weblogic-jsp-error-source-disclosure(26461)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26461"
},
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016100",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016100"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2466",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-2141
Vulnerability from cvelistv5
Published
2005-11-16 21:17
Modified
2024-08-08 03:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.iss.net/security_center/static/10291.php | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/5846 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/39 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:51:17.459Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-servlet-ejb-security-removal(10291)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/10291.php"
},
{
"name": "5846",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5846"
},
{
"name": "BEA02-21.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/39"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-10-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-servlet-ejb-security-removal(10291)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/10291.php"
},
{
"name": "5846",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5846"
},
{
"name": "BEA02-21.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/39"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-2141",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-servlet-ejb-security-removal(10291)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/10291.php"
},
{
"name": "5846",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5846"
},
{
"name": "BEA02-21.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/39"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-2141",
"datePublished": "2005-11-16T21:17:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-08T03:51:17.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2472
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/186 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1016095 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26466 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.629Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-124.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/186"
},
{
"name": "1016095",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016095"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-private-key-disclosure(26466)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26466"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-124.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/186"
},
{
"name": "1016095",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016095"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-private-key-disclosure(26466)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26466"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2472",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-124.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/186"
},
{
"name": "1016095",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016095"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-private-key-disclosure(26466)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26466"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2472",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2001-0098
Vulnerability from cvelistv5
Published
2001-02-02 05:00
Modified
2024-08-08 04:06
Severity ?
EPSS score ?
Summary
Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/2138 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/5782 | vdb-entry, x_refsource_XF | |
| http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T04:06:55.296Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "2138",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/2138"
},
{
"name": "weblogic-dot-bo(5782)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5782"
},
{
"name": "20001219 def-2000-04: Bea WebLogic Server dotdot-overflow",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-12-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a \"..\" string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-18T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "2138",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/2138"
},
{
"name": "weblogic-dot-bo(5782)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5782"
},
{
"name": "20001219 def-2000-04: Bea WebLogic Server dotdot-overflow",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2001-0098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a \"..\" string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "2138",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/2138"
},
{
"name": "weblogic-dot-bo(5782)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5782"
},
{
"name": "20001219 def-2000-04: Bea WebLogic Server dotdot-overflow",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2001-0098",
"datePublished": "2001-02-02T05:00:00",
"dateReserved": "2001-02-01T00:00:00",
"dateUpdated": "2024-08-08T04:06:55.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0499
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:21
Severity ?
EPSS score ?
Summary
The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/1328 | vdb-entry, x_refsource_BID | |
| http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm | mailing-list, x_refsource_NTBUGTRAQ | |
| http://developer.bea.com/alerts/security_000612.html | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/4694 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:21:30.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1328",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1328"
},
{
"name": "20000612 BEA WebLogic JSP showcode vulnerability",
"tags": [
"mailing-list",
"x_refsource_NTBUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://developer.bea.com/alerts/security_000612.html"
},
{
"name": "weblogic-jsp-source-read(4694)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4694"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-06-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1328",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1328"
},
{
"name": "20000612 BEA WebLogic JSP showcode vulnerability",
"tags": [
"mailing-list",
"x_refsource_NTBUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://developer.bea.com/alerts/security_000612.html"
},
{
"name": "weblogic-jsp-source-read(4694)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4694"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1328",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1328"
},
{
"name": "20000612 BEA WebLogic JSP showcode vulnerability",
"refsource": "NTBUGTRAQ",
"url": "http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm"
},
{
"name": "http://developer.bea.com/alerts/security_000612.html",
"refsource": "CONFIRM",
"url": "http://developer.bea.com/alerts/security_000612.html"
},
{
"name": "weblogic-jsp-source-read(4694)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4694"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0499",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-07-11T00:00:00",
"dateUpdated": "2024-08-08T05:21:30.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1746
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/0606 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/129 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.070Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0606",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0606"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-79.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/129"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0606",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0606"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-79.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/129"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1746",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0606",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0606"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-79.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/129"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1746",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2697
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/229 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/36072 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34291 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.266Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-161.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/229"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36072",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36072"
},
{
"name": "weblogic-ldap-brute-force(34291)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34291"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-161.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/229"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36072",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36072"
},
{
"name": "weblogic-ldap-brute-force(34291)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34291"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2697",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-161.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/229"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36072",
"refsource": "OSVDB",
"url": "http://osvdb.org/36072"
},
{
"name": "weblogic-ldap-brute-force(34291)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34291"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2697",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0711
Vulnerability from cvelistv5
Published
2004-07-21 04:00
Modified
2024-08-08 00:24
Severity ?
EPSS score ?
Summary
The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/10184 | vdb-entry, x_refsource_BID | |
| http://www.kb.cert.org/vuls/id/184558 | third-party-advisory, x_refsource_CERT-VN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15927 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:24:27.161Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "10184",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10184"
},
{
"name": "VU#184558",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/184558"
},
{
"name": "weblogic-urlpattern-obtain-information(15927)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15927"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in \"*\" as wildcards as if they were the legal \"/*\" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "10184",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10184"
},
{
"name": "VU#184558",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/184558"
},
{
"name": "weblogic-urlpattern-obtain-information(15927)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15927"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0711",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in \"*\" as wildcards as if they were the legal \"/*\" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "10184",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10184"
},
{
"name": "VU#184558",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/184558"
},
{
"name": "weblogic-urlpattern-obtain-information(15927)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15927"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0711",
"datePublished": "2004-07-21T04:00:00",
"dateReserved": "2004-07-20T00:00:00",
"dateUpdated": "2024-08-08T00:24:27.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2704
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34278 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/237 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/36064 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.248Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-ssl-port-dos(34278)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34278"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-168.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/237"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36064"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-ssl-port-dos(34278)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34278"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-168.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/237"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36064"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-ssl-port-dos(34278)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34278"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-168.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/237"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36064",
"refsource": "OSVDB",
"url": "http://osvdb.org/36064"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2704",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1748
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/0608 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/131 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.218Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0608",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0608"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-81.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0608",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0608"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-81.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1748",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0608",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0608"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-81.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1748",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1222
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/9034 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/63 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:46.030Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-41.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/63"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-41.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/63"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1222",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9034",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-41.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/63"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1222",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:46.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0902
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/273 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.105Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-80.04",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-80.04",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0902",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0422
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/166 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24294 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.493Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-109.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/166"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-java-mbean-access(24294)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24294"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-109.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/166"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-java-mbean-access(24294)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24294"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0422",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-109.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/166"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-java-mbean-access(24294)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24294"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0422",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4764
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-17 03:43
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins).
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/155 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-101.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/155"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-101.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/155"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4764",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-101.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/155"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4764",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-17T03:43:22.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4758
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 17:59
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/148 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.070Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-94.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/148"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an \"internal servlet\" accessed through HTTP."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-94.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/148"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4758",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an \"internal servlet\" accessed through HTTP."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-94.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/148"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4758",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T17:59:13.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1755
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 01:00
Severity ?
EPSS score ?
Summary
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/858990 | third-party-advisory, x_refsource_CERT-VN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15826 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/10725 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/9502 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:00:37.214Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#858990",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/858990"
},
{
"name": "weblogic-multiple-connection-gain-access(15826)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15826"
},
{
"name": "10725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10725"
},
{
"name": "9502",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9502"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "VU#858990",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/858990"
},
{
"name": "weblogic-multiple-connection-gain-access(15826)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15826"
},
{
"name": "10725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10725"
},
{
"name": "9502",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9502"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1755",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#858990",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/858990"
},
{
"name": "weblogic-multiple-connection-gain-access(15826)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15826"
},
{
"name": "10725",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10725"
},
{
"name": "9502",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9502"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1755",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T01:00:37.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2694
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/36075 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/232 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36075",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36075"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-80.03",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/232"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-11-15T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36075",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36075"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-80.03",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/232"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2694",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36075",
"refsource": "OSVDB",
"url": "http://osvdb.org/36075"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "BEA07-80.03",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/232"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2694",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0204
Vulnerability from cvelistv5
Published
2004-06-11 04:00
Modified
2024-08-08 00:10
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=108360413811017&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp | x_refsource_CONFIRM | |
| http://secunia.com/advisories/11800 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=108671836127360&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16044 | vdb-entry, x_refsource_XF | |
| http://www.osvdb.org/6748 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/10260 | vdb-entry, x_refsource_BID | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157 | vdb-entry, signature, x_refsource_OVAL | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017 | vendor-advisory, x_refsource_MS |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:10:03.760Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20040502 Crystal Reports Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108360413811017\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp"
},
{
"name": "11800",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11800"
},
{
"name": "20040608 Vulnerability: Arbitrary File Access \u0026 DoS in Crystal Reports",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108671836127360\u0026w=2"
},
{
"name": "crystalreports-file-deletion(16044)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16044"
},
{
"name": "6748",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/6748"
},
{
"name": "10260",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10260"
},
{
"name": "oval:org.mitre.oval:def:1157",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157"
},
{
"name": "MS04-017",
"tags": [
"vendor-advisory",
"x_refsource_MS",
"x_transferred"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-06-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via \"..\" sequences in the dynamicimag argument to crystalimagehandler.aspx."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-12T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20040502 Crystal Reports Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108360413811017\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp"
},
{
"name": "11800",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11800"
},
{
"name": "20040608 Vulnerability: Arbitrary File Access \u0026 DoS in Crystal Reports",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108671836127360\u0026w=2"
},
{
"name": "crystalreports-file-deletion(16044)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16044"
},
{
"name": "6748",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/6748"
},
{
"name": "10260",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10260"
},
{
"name": "oval:org.mitre.oval:def:1157",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157"
},
{
"name": "MS04-017",
"tags": [
"vendor-advisory",
"x_refsource_MS"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via \"..\" sequences in the dynamicimag argument to crystalimagehandler.aspx."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20040502 Crystal Reports Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=108360413811017\u0026w=2"
},
{
"name": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp",
"refsource": "CONFIRM",
"url": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp"
},
{
"name": "11800",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11800"
},
{
"name": "20040608 Vulnerability: Arbitrary File Access \u0026 DoS in Crystal Reports",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=108671836127360\u0026w=2"
},
{
"name": "crystalreports-file-deletion(16044)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16044"
},
{
"name": "6748",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/6748"
},
{
"name": "10260",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10260"
},
{
"name": "oval:org.mitre.oval:def:1157",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157"
},
{
"name": "MS04-017",
"refsource": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0204",
"datePublished": "2004-06-11T04:00:00",
"dateReserved": "2004-03-11T00:00:00",
"dateUpdated": "2024-08-08T00:10:03.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1238
Vulnerability from cvelistv5
Published
2005-11-16 21:17
Modified
2024-08-08 05:45
Severity ?
EPSS score ?
Summary
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/5588 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/5089 | vdb-entry, x_refsource_BID | |
| ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.536Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-bypass-auth(5588)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588"
},
{
"name": "5089",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5089"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-11-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-bypass-auth(5588)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588"
},
{
"name": "5089",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5089"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1238",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-bypass-auth(5588)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588"
},
{
"name": "5089",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5089"
},
{
"name": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip",
"refsource": "CONFIRM",
"url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1238",
"datePublished": "2005-11-16T21:17:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-08T05:45:37.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1437
Vulnerability from cvelistv5
Published
2007-10-23 01:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/6719 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/11220 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA03-25.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp"
},
{
"name": "6719",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/6719"
},
{
"name": "weblogic-keystore-plaintext-passwords(11220)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11220"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-01-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA03-25.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp"
},
{
"name": "6719",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/6719"
},
{
"name": "weblogic-keystore-plaintext-passwords(11220)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11220"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1437",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA03-25.00",
"refsource": "BEA",
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp"
},
{
"name": "6719",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/6719"
},
{
"name": "weblogic-keystore-plaintext-passwords(11220)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11220"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1437",
"datePublished": "2007-10-23T01:00:00",
"dateReserved": "2007-10-22T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1756
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 01:00
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/11358 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/10132 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15862 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1009765 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp | x_refsource_CONFIRM | |
| http://www.kb.cert.org/vuls/id/566390 | third-party-advisory, x_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:00:37.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "11358",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11358"
},
{
"name": "10132",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10132"
},
{
"name": "weblogic-trust-certificate-spoofing(15862)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15862"
},
{
"name": "1009765",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1009765"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp"
},
{
"name": "VU#566390",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/566390"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "11358",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11358"
},
{
"name": "10132",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10132"
},
{
"name": "weblogic-trust-certificate-spoofing(15862)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15862"
},
{
"name": "1009765",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1009765"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp"
},
{
"name": "VU#566390",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/566390"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1756",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "11358",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11358"
},
{
"name": "10132",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10132"
},
{
"name": "weblogic-trust-certificate-spoofing(15862)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15862"
},
{
"name": "1009765",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1009765"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp"
},
{
"name": "VU#566390",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/566390"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1756",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T01:00:37.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0430
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/174 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24301 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-117.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/174"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "weblogic-connection-filter-dos(24301)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24301"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-117.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/174"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "weblogic-connection-filter-dos(24301)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24301"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0430",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-117.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/174"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "weblogic-connection-filter-dos(24301)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24301"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0430",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4765
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-17 01:06
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/156 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-102.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/156"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-102.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/156"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4765",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-102.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/156"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4765",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-17T01:06:46.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2468
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26468 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/190 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1016099 | vdb-entry, x_refsource_SECTRACK | |
| http://securitytracker.com/id?1016097 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.778Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-domain-name-disclosure(26468)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26468"
},
{
"name": "BEA06-128.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/190"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016097"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-domain-name-disclosure(26468)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26468"
},
{
"name": "BEA06-128.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/190"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016097"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2468",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-domain-name-disclosure(26468)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26468"
},
{
"name": "BEA06-128.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/190"
},
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016097"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2468",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0621
Vulnerability from cvelistv5
Published
2003-11-05 05:00
Modified
2024-08-08 01:58
Severity ?
EPSS score ?
Summary
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=106762000607681&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/13559 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/8931 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:58:11.123Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "bea-tuxedo-file-disclosure(13559)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13559"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "bea-tuxedo-file-disclosure(13559)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13559"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0621",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "bea-tuxedo-file-disclosure(13559)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13559"
},
{
"name": "8931",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8931"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0621",
"datePublished": "2003-11-05T05:00:00",
"dateReserved": "2003-07-31T00:00:00",
"dateUpdated": "2024-08-08T01:58:11.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0424
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/32856 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/219 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32856",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32856"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-152.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/219"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32856",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32856"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-152.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/219"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0424",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32856",
"refsource": "OSVDB",
"url": "http://osvdb.org/32856"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-152.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/219"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0424",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0425
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/222 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38515 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-155.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/222"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38515",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an \"overflow condition,\" probably a buffer overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-11-13T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-155.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/222"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38515",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0425",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an \"overflow condition,\" probably a buffer overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-155.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/222"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38515",
"refsource": "OSVDB",
"url": "http://osvdb.org/38515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0425",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1749
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping).
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/0609 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/132 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.098Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0609",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0609"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-82.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/132"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0609",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0609"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-82.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/132"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1749",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0609",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0609"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-82.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/132"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1749",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0900
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1019439 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/270 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.091Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019439",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019439",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"name": "BEA08-196.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0900",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4613
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/201 | vendor-advisory, x_refsource_BEA | |
| http://osvdb.org/45838 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.933Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-134.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/201"
},
{
"name": "45838",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/45838"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-11-13T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-134.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/201"
},
{
"name": "45838",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/45838"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4613",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-134.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/201"
},
{
"name": "45838",
"refsource": "OSVDB",
"url": "http://osvdb.org/45838"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4613",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1744
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2005/0604 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/127 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.103Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-0604",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0604"
},
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "BEA05-77.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-0604",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0604"
},
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "BEA05-77.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1744",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-0604",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0604"
},
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "BEA05-77.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1744",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4757
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 20:27
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/147 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.092Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-93.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/147"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly \"constrain\" a \"/\" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-93.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/147"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4757",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly \"constrain\" a \"/\" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-93.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/147"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4757",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T20:27:40.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4615
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/26539 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/244 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/25472 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/3008 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1018619 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36322 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.673Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "BEA07-175.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/244"
},
{
"name": "25472",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "1018619",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018619"
},
{
"name": "weblogic-cipher-information-disclosure(36322)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36322"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-08-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "BEA07-175.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/244"
},
{
"name": "25472",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "1018619",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018619"
},
{
"name": "weblogic-cipher-information-disclosure(36322)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36322"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4615",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "26539",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26539"
},
{
"name": "BEA07-175.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/244"
},
{
"name": "25472",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "ADV-2007-3008",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "1018619",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018619"
},
{
"name": "weblogic-cipher-information-disclosure(36322)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36322"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4615",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1290
Vulnerability from cvelistv5
Published
2006-01-13 11:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI).
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/162 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/9034 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/10218 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/18396 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/3064 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/16215 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/13752 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:46.077Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA03-43.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/162"
},
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "10218",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10218"
},
{
"name": "18396",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18396"
},
{
"name": "3064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3064"
},
{
"name": "16215",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16215"
},
{
"name": "weblogic-mbeanhome-obtain-information(13752)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13752"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA03-43.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/162"
},
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "10218",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10218"
},
{
"name": "18396",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18396"
},
{
"name": "3064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3064"
},
{
"name": "16215",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16215"
},
{
"name": "weblogic-mbeanhome-obtain-information(13752)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13752"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1290",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA03-43.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/162"
},
{
"name": "9034",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "10218",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10218"
},
{
"name": "18396",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18396"
},
{
"name": "3064",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3064"
},
{
"name": "16215",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16215"
},
{
"name": "weblogic-mbeanhome-obtain-information(13752)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13752"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1290",
"datePublished": "2006-01-13T11:00:00",
"dateReserved": "2006-01-13T00:00:00",
"dateUpdated": "2024-08-08T02:19:46.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4759
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 19:00
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/149 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.138Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-95.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/149"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-95.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/149"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4759",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-95.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/149"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4759",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T19:00:48.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0416
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/38510 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/210 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.969Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38510",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38510"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-143.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/210"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38510",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38510"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-143.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/210"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0416",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38510",
"refsource": "OSVDB",
"url": "http://osvdb.org/38510"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-143.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/210"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0416",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4754
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 20:47
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/144 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.026Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-90.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/144"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving \"network address translation.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-90.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/144"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4754",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving \"network address translation.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-90.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/144"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4754",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T20:47:01.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1743
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/0603 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/126 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.377Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0603",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0603"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-76.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/126"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0603",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0603"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-76.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/126"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1743",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0603",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0603"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "BEA05-76.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/126"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1743",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0418
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/38512 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/212 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.935Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38512",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38512"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-145.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/212"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38512",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38512"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-145.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/212"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0418",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38512",
"refsource": "OSVDB",
"url": "http://osvdb.org/38512"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-145.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/212"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0418",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0901
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/271 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://www.s21sec.com/avisos/s21sec-040-en.txt | x_refsource_MISC | |
| http://www.securitytracker.com/id?1019449 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/archive/1/488686/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.056Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-197.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0901",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-197.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "http://www.s21sec.com/avisos/s21sec-040-en.txt",
"refsource": "MISC",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"name": "1019449",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"name": "20080225 S21SEC-040-en: Infinite invalid authentication attempts possible in BEA WebLogic Server",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0901",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-0106
Vulnerability from cvelistv5
Published
2002-03-15 05:00
Modified
2024-08-08 02:35
Severity ?
EPSS score ?
Summary
BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.iss.net/security_center/static/7808.php | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=101050440629269&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/3816 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:35:17.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-dos-jsp-dos(7808)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/7808.php"
},
{
"name": "20020108 KPMG-2002003: Bea Weblogic DOS-device Denial of Service",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=101050440629269\u0026w=2"
},
{
"name": "3816",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/3816"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-01-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-dos-jsp-dos(7808)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/7808.php"
},
{
"name": "20020108 KPMG-2002003: Bea Weblogic DOS-device Denial of Service",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=101050440629269\u0026w=2"
},
{
"name": "3816",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/3816"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-0106",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-dos-jsp-dos(7808)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/7808.php"
},
{
"name": "20020108 KPMG-2002003: Bea Weblogic DOS-device Denial of Service",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=101050440629269\u0026w=2"
},
{
"name": "3816",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/3816"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-0106",
"datePublished": "2002-03-15T05:00:00",
"dateReserved": "2002-03-15T00:00:00",
"dateUpdated": "2024-08-08T02:35:17.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1095
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 02:12
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/7130 | vdb-entry, x_refsource_BID | |
| http://www.kb.cert.org/vuls/id/691153 | third-party-advisory, x_refsource_CERT-VN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:12:36.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp"
},
{
"name": "7130",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7130"
},
{
"name": "VU#691153",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/691153"
},
{
"name": "weblogic-app-reauthentication-bypass(11555)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11555"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-03-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using \"memory\" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp"
},
{
"name": "7130",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7130"
},
{
"name": "VU#691153",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/691153"
},
{
"name": "weblogic-app-reauthentication-bypass(11555)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11555"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1095",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using \"memory\" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp"
},
{
"name": "7130",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7130"
},
{
"name": "VU#691153",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/691153"
},
{
"name": "weblogic-app-reauthentication-bypass(11555)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11555"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1095",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-11T00:00:00",
"dateUpdated": "2024-08-08T02:12:36.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0432
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24299 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/176 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.806Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-jdni-security-weakness(24299)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24299"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-119.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/176"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-jdni-security-weakness(24299)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24299"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-119.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/176"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0432",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-jdni-security-weakness(24299)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24299"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-119.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/176"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0432",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0500
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:21
Severity ?
EPSS score ?
Summary
The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=96161462915381&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.weblogic.com/docs51/admindocs/http.html#file | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/1378 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/4775 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:21:31.241Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20000621 BEA WebLogic /file/ showcode vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=96161462915381\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.weblogic.com/docs51/admindocs/http.html#file"
},
{
"name": "1378",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1378"
},
{
"name": "weblogic-file-source-read(4775)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4775"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20000621 BEA WebLogic /file/ showcode vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=96161462915381\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.weblogic.com/docs51/admindocs/http.html#file"
},
{
"name": "1378",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1378"
},
{
"name": "weblogic-file-source-read(4775)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4775"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0500",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20000621 BEA WebLogic /file/ showcode vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=96161462915381\u0026w=2"
},
{
"name": "http://www.weblogic.com/docs51/admindocs/http.html#file",
"refsource": "CONFIRM",
"url": "http://www.weblogic.com/docs51/admindocs/http.html#file"
},
{
"name": "1378",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1378"
},
{
"name": "weblogic-file-source-read(4775)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4775"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0500",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-07-11T00:00:00",
"dateUpdated": "2024-08-08T05:21:31.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4767
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 19:35
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/161 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/178 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/17168 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:22.559Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-107.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/161"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA06-107.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/178"
},
{
"name": "17168",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17168"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-107.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/161"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA06-107.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/178"
},
{
"name": "17168",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17168"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4767",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-107.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/161"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA06-107.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/178"
},
{
"name": "17168",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17168"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4767",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T19:35:00.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4614
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/45839 | vdb-entry, x_refsource_OSVDB | |
| http://dev2dev.bea.com/pub/advisory/216 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "45839",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/45839"
},
{
"name": "BEA07-149.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/216"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.1 does not properly handle propagation of an admin server\u0027s security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-11-13T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "45839",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/45839"
},
{
"name": "BEA07-149.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/216"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4614",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 9.1 does not properly handle propagation of an admin server\u0027s security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "45839",
"refsource": "OSVDB",
"url": "http://osvdb.org/45839"
},
{
"name": "BEA07-149.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/216"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4614",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0419
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/163 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.652Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-81.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/163"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-81.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/163"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0419",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-81.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/163"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0419",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-2375
Vulnerability from cvelistv5
Published
2010-07-13 22:07
Modified
2024-08-07 02:32
Severity ?
EPSS score ?
Summary
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.381Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-10-23T09:00:00",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert_us@oracle.com",
"ID": "CVE-2010-2375",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2010-2375",
"datePublished": "2010-07-13T22:07:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0420
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38514 | vdb-entry, x_refsource_OSVDB | |
| http://dev2dev.bea.com/pub/advisory/214 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.108Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38514"
},
{
"name": "BEA07-147.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/214"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38514"
},
{
"name": "BEA07-147.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/214"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0420",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38514",
"refsource": "OSVDB",
"url": "http://osvdb.org/38514"
},
{
"name": "BEA07-147.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/214"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0420",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2699
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/231 | vendor-advisory, x_refsource_BEA | |
| http://osvdb.org/36069 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN | |
| http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.306Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-164.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/231"
},
{
"name": "36069",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36069"
},
{
"name": "weblogic-adminconsole-insecure-permissions(34289)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34289"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-28T16:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-164.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/231"
},
{
"name": "36069",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36069"
},
{
"name": "weblogic-adminconsole-insecure-permissions(34289)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34289"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2699",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-164.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/231"
},
{
"name": "36069",
"refsource": "OSVDB",
"url": "http://osvdb.org/36069"
},
{
"name": "weblogic-adminconsole-insecure-permissions(34289)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34289"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2699",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0712
Vulnerability from cvelistv5
Published
2004-07-21 04:00
Modified
2024-08-08 00:24
Severity ?
EPSS score ?
Summary
The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/574222 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/10188 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15926 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:24:27.199Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#574222",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/574222"
},
{
"name": "10188",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10188"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp"
},
{
"name": "weblogic-admin-password-plaintext(15926)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15926"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "VU#574222",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/574222"
},
{
"name": "10188",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10188"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp"
},
{
"name": "weblogic-admin-password-plaintext(15926)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15926"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0712",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#574222",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/574222"
},
{
"name": "10188",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10188"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp"
},
{
"name": "weblogic-admin-password-plaintext(15926)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15926"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0712",
"datePublished": "2004-07-21T04:00:00",
"dateReserved": "2004-07-20T00:00:00",
"dateUpdated": "2024-08-08T00:24:27.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0624
Vulnerability from cvelistv5
Published
2003-11-05 05:00
Modified
2024-08-08 01:58
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp | x_refsource_MISC | |
| http://www.securityfocus.com/bid/8938 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/13568 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=106761926906781&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:58:11.062Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"name": "8938",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8938"
},
{
"name": "bea-weblogic-interactivequery-xss(13568)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13568"
},
{
"name": "20031031 Corsaire Security Advisory: BEA WebLogic example InteractiveQuery.jsp XSS issue",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106761926906781\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"name": "8938",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8938"
},
{
"name": "bea-weblogic-interactivequery-xss(13568)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13568"
},
{
"name": "20031031 Corsaire Security Advisory: BEA WebLogic example InteractiveQuery.jsp XSS issue",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106761926906781\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0624",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp",
"refsource": "MISC",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"name": "8938",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8938"
},
{
"name": "bea-weblogic-interactivequery-xss(13568)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13568"
},
{
"name": "20031031 Corsaire Security Advisory: BEA WebLogic example InteractiveQuery.jsp XSS issue",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=106761926906781\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0624",
"datePublished": "2003-11-05T05:00:00",
"dateReserved": "2003-07-31T00:00:00",
"dateUpdated": "2024-08-08T01:58:11.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0640
Vulnerability from cvelistv5
Published
2003-08-02 04:00
Modified
2024-08-08 01:58
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.secunia.com/advisories/9232/ | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:58:11.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9232",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://www.secunia.com/advisories/9232/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-01-20T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9232",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://www.secunia.com/advisories/9232/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0640",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9232",
"refsource": "SECUNIA",
"url": "http://www.secunia.com/advisories/9232/"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0640",
"datePublished": "2003-08-02T04:00:00",
"dateReserved": "2003-08-01T00:00:00",
"dateUpdated": "2024-08-08T01:58:11.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1093
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 02:12
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a ResourceAllocationException.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/6586 | vdb-entry, x_refsource_BID | |
| http://www.kb.cert.org/vuls/id/331937 | third-party-advisory, x_refsource_CERT-VN | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/11057 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:12:36.009Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "6586",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/6586"
},
{
"name": "VU#331937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/331937"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp"
},
{
"name": "weblogic-error-password-disclosure(11057)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11057"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-01-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user\u0027s password when it throws a ResourceAllocationException."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "6586",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/6586"
},
{
"name": "VU#331937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/331937"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp"
},
{
"name": "weblogic-error-password-disclosure(11057)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11057"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1093",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user\u0027s password when it throws a ResourceAllocationException."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "6586",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/6586"
},
{
"name": "VU#331937",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/331937"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp"
},
{
"name": "weblogic-error-password-disclosure(11057)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11057"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1093",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T02:12:36.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0470
Vulnerability from cvelistv5
Published
2004-05-20 04:00
Modified
2024-08-08 00:17
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/11593 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16123 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp | x_refsource_CONFIRM | |
| http://securitytracker.com/id?1010128 | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/6076 | vdb-entry, x_refsource_OSVDB | |
| http://www.kb.cert.org/vuls/id/950070 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/10328 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:17:14.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "11593",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11593"
},
{
"name": "weblogic-application-unauth-access(16123)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16123"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp"
},
{
"name": "1010128",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010128"
},
{
"name": "6076",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/6076"
},
{
"name": "VU#950070",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/950070"
},
{
"name": "10328",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10328"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-05-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "11593",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11593"
},
{
"name": "weblogic-application-unauth-access(16123)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16123"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp"
},
{
"name": "1010128",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010128"
},
{
"name": "6076",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/6076"
},
{
"name": "VU#950070",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/950070"
},
{
"name": "10328",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10328"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0470",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "11593",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11593"
},
{
"name": "weblogic-application-unauth-access(16123)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16123"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp"
},
{
"name": "1010128",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010128"
},
{
"name": "6076",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/6076"
},
{
"name": "VU#950070",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/950070"
},
{
"name": "10328",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10328"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0470",
"datePublished": "2004-05-20T04:00:00",
"dateReserved": "2004-05-13T00:00:00",
"dateUpdated": "2024-08-08T00:17:14.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4756
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 20:01
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/146 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-92.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/146"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-92.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/146"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4756",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-92.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/146"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4756",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T20:01:31.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2320
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/14959 | vdb-entry, x_refsource_XF | |
| http://www.kb.cert.org/vuls/id/867593 | third-party-advisory, x_refsource_CERT-VN | |
| http://dev2dev.bea.com/pub/advisory/68 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/9506 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/10726 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securitytracker.com/alerts/2004/Jan/1008866.html | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/3726 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:13.662Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-trace-xss(14959)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14959"
},
{
"name": "VU#867593",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/867593"
},
{
"name": "BEA04-48.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/68"
},
{
"name": "9506",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9506"
},
{
"name": "10726",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10726"
},
{
"name": "1008866",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008866.html"
},
{
"name": "3726",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3726"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-trace-xss(14959)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14959"
},
{
"name": "VU#867593",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/867593"
},
{
"name": "BEA04-48.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/68"
},
{
"name": "9506",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9506"
},
{
"name": "10726",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10726"
},
{
"name": "1008866",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008866.html"
},
{
"name": "3726",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3726"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2320",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-trace-xss(14959)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14959"
},
{
"name": "VU#867593",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/867593"
},
{
"name": "BEA04-48.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/68"
},
{
"name": "9506",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9506"
},
{
"name": "10726",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10726"
},
{
"name": "1008866",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008866.html"
},
{
"name": "3726",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3726"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2320",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T01:22:13.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-1030
Vulnerability from cvelistv5
Published
2003-04-02 05:00
Modified
2024-08-08 03:12
Severity ?
EPSS score ?
Summary
Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html | mailing-list, x_refsource_VULNWATCH | |
| http://www.securityfocus.com/bid/5159 | vdb-entry, x_refsource_BID | |
| http://www.iss.net/security_center/static/9486.php | vdb-entry, x_refsource_XF | |
| http://online.securityfocus.com/archive/1/281046 | mailing-list, x_refsource_BUGTRAQ | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications&path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:12:16.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20020708 [VulnWatch] KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html"
},
{
"name": "5159",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5159"
},
{
"name": "weblogic-race-condition-dos(9486)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/9486.php"
},
{
"name": "20020708 KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://online.securityfocus.com/archive/1/281046"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-07-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2002-09-10T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20020708 [VulnWatch] KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html"
},
{
"name": "5159",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5159"
},
{
"name": "weblogic-race-condition-dos(9486)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/9486.php"
},
{
"name": "20020708 KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://online.securityfocus.com/archive/1/281046"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-1030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20020708 [VulnWatch] KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"refsource": "VULNWATCH",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html"
},
{
"name": "5159",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5159"
},
{
"name": "weblogic-race-condition-dos(9486)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/9486.php"
},
{
"name": "20020708 KPMG-2002029: Bea Weblogic Performance Pack Denial of Service",
"refsource": "BUGTRAQ",
"url": "http://online.securityfocus.com/archive/1/281046"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-1030",
"datePublished": "2003-04-02T05:00:00",
"dateReserved": "2002-08-27T00:00:00",
"dateUpdated": "2024-08-08T03:12:16.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0413
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/207 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38504 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.989Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-140.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/207"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38504",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38504"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-140.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/207"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38504",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38504"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-140.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/207"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38504",
"refsource": "OSVDB",
"url": "http://osvdb.org/38504"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0413",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0421
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/165 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24286 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18581 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.660Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-108.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/165"
},
{
"name": "weblogic-cross-domain-management(24286)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24286"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18581",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18581"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-108.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/165"
},
{
"name": "weblogic-cross-domain-management(24286)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24286"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18581",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18581"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0421",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-108.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/165"
},
{
"name": "weblogic-cross-domain-management(24286)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24286"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18581",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18581"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0421",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4617
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/26539 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/3008 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38518 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36319 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/246 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.886Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "38518",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38518"
},
{
"name": "weblogic-unspecified-dos(36319)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36319"
},
{
"name": "BEA07-87.02",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/246"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-08-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "38518",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38518"
},
{
"name": "weblogic-unspecified-dos(36319)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36319"
},
{
"name": "BEA07-87.02",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/246"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4617",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "26539",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26539"
},
{
"name": "ADV-2007-3008",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "38518",
"refsource": "OSVDB",
"url": "http://osvdb.org/38518"
},
{
"name": "weblogic-unspecified-dos(36319)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36319"
},
{
"name": "BEA07-87.02",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/246"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4617",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0715
Vulnerability from cvelistv5
Published
2004-07-21 04:00
Modified
2024-08-08 00:24
Severity ?
EPSS score ?
Summary
The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp | x_refsource_CONFIRM | |
| http://www.osvdb.org/5299 | vdb-entry, x_refsource_OSVDB | |
| http://www.kb.cert.org/vuls/id/470470 | third-party-advisory, x_refsource_CERT-VN | |
| http://securitytracker.com/id?1009763 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/10130 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/11356 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15861 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:24:27.166Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp"
},
{
"name": "5299",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/5299"
},
{
"name": "VU#470470",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/470470"
},
{
"name": "1009763",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1009763"
},
{
"name": "10130",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10130"
},
{
"name": "11356",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11356"
},
{
"name": "weblogic-authentication-gain-privileges(15861)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp"
},
{
"name": "5299",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/5299"
},
{
"name": "VU#470470",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/470470"
},
{
"name": "1009763",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1009763"
},
{
"name": "10130",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10130"
},
{
"name": "11356",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11356"
},
{
"name": "weblogic-authentication-gain-privileges(15861)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0715",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp"
},
{
"name": "5299",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/5299"
},
{
"name": "VU#470470",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/470470"
},
{
"name": "1009763",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1009763"
},
{
"name": "10130",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10130"
},
{
"name": "11356",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11356"
},
{
"name": "weblogic-authentication-gain-privileges(15861)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0715",
"datePublished": "2004-07-21T04:00:00",
"dateReserved": "2004-07-20T00:00:00",
"dateUpdated": "2024-08-08T00:24:27.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0429
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://www.osvdb.org/22773 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24298 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/173 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.827Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22773",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22773"
},
{
"name": "weblogic-security-provider-weakness(24298)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24298"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-116.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/173"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22773",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22773"
},
{
"name": "weblogic-security-provider-weakness(24298)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24298"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-116.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/173"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0429",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22773",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22773"
},
{
"name": "weblogic-security-provider-weakness(24298)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24298"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-116.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/173"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0429",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0421
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/32859 | vdb-entry, x_refsource_OSVDB | |
| http://dev2dev.bea.com/pub/advisory/215 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.921Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32859",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32859"
},
{
"name": "BEA07-148.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/215"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32859",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32859"
},
{
"name": "BEA07-148.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/215"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0421",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "32859",
"refsource": "OSVDB",
"url": "http://osvdb.org/32859"
},
{
"name": "BEA07-148.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/215"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0421",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1224
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7563 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/22 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:45.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user\u0027s password by physically observing (\"shoulder surfing\") the screen."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-08-19T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1224",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user\u0027s password by physically observing (\"shoulder surfing\") the screen."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7563",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1224",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:45.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0683
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:28
Severity ?
EPSS score ?
Summary
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.osvdb.org/1480 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/1517 | vdb-entry, x_refsource_BID | |
| http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html | mailing-list, x_refsource_BUGTRAQ | |
| http://developer.bea.com/alerts/security_000728.html | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:28:41.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1480",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/1480"
},
{
"name": "1517",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1517"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://developer.bea.com/alerts/security_000728.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2004-09-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1480",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/1480"
},
{
"name": "1517",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1517"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://developer.bea.com/alerts/security_000728.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0683",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1480",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/1480"
},
{
"name": "1517",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1517"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"name": "http://developer.bea.com/alerts/security_000728.html",
"refsource": "CONFIRM",
"url": "http://developer.bea.com/alerts/security_000728.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0683",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-09-19T00:00:00",
"dateUpdated": "2024-08-08T05:28:41.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4753
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 16:32
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/143 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-89.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/143"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain \"heavy usage\" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-89.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/143"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4753",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain \"heavy usage\" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-89.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/143"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4753",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T16:32:49.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2698
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/36071 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/230 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34286 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.065Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "36071",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36071"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "BEA07-162.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/230"
},
{
"name": "weblogic-config-information-disclosure(34286)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34286"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "36071",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36071"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "BEA07-162.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/230"
},
{
"name": "weblogic-config-information-disclosure(34286)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34286"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2698",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "36071",
"refsource": "OSVDB",
"url": "http://osvdb.org/36071"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "BEA07-162.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/230"
},
{
"name": "weblogic-config-information-disclosure(34286)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34286"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2698",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0623
Vulnerability from cvelistv5
Published
2003-11-05 05:00
Modified
2024-08-08 01:58
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/13561 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=106762000607681&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/8931 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:58:11.245Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "bea-tuxedo-filename-xss(13561)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13561"
},
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "bea-tuxedo-filename-xss(13561)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13561"
},
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0623",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "bea-tuxedo-filename-xss(13561)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13561"
},
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8931"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0623",
"datePublished": "2003-11-05T05:00:00",
"dateReserved": "2003-07-31T00:00:00",
"dateUpdated": "2024-08-08T01:58:11.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0427
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/171 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/22774 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24291 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-114.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/171"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "22774",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22774"
},
{
"name": "weblogic-servlets-obtain-information(24291)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24291"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-114.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/171"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "22774",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22774"
},
{
"name": "weblogic-servlets-obtain-information(24291)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24291"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0427",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "BEA06-114.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/171"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "22774",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22774"
},
{
"name": "weblogic-servlets-obtain-information(24291)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24291"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0427",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1094
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 02:12
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/8320 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12799 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp | x_refsource_CONFIRM | |
| http://www.kb.cert.org/vuls/id/999788 | third-party-advisory, x_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:12:36.092Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "8320",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8320"
},
{
"name": "weblogic-gain-privileges(12799)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12799"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp"
},
{
"name": "VU#999788",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/999788"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-07-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "8320",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8320"
},
{
"name": "weblogic-gain-privileges(12799)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12799"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp"
},
{
"name": "VU#999788",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/999788"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1094",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "8320",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8320"
},
{
"name": "weblogic-gain-privileges(12799)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12799"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp"
},
{
"name": "VU#999788",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/999788"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1094",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T02:12:36.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1351
Vulnerability from cvelistv5
Published
2006-03-22 01:00
Modified
2024-08-07 17:12
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1015792 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25347 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/180 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/19310 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1021 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/17166 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:12:20.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1015792",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015792"
},
{
"name": "weblogic-server-default-servlet(25347)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25347"
},
{
"name": "BEA06-120.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/180"
},
{
"name": "19310",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"name": "17166",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17166"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-03-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a \"default internal servlet\" accessed through HTTP."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1015792",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015792"
},
{
"name": "weblogic-server-default-servlet(25347)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25347"
},
{
"name": "BEA06-120.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/180"
},
{
"name": "19310",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"name": "17166",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17166"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1351",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a \"default internal servlet\" accessed through HTTP."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1015792",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015792"
},
{
"name": "weblogic-server-default-servlet(25347)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25347"
},
{
"name": "BEA06-120.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/180"
},
{
"name": "19310",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"name": "17166",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17166"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1351",
"datePublished": "2006-03-22T01:00:00",
"dateReserved": "2006-03-21T00:00:00",
"dateUpdated": "2024-08-07T17:12:20.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0432
Vulnerability from cvelistv5
Published
2005-02-15 05:00
Modified
2024-08-07 21:13
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/14298 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:13:54.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "14298",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14298"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-02-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T16:38:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "14298",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14298"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0432",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "14298",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14298"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0432",
"datePublished": "2005-02-15T05:00:00",
"dateReserved": "2005-02-15T00:00:00",
"dateUpdated": "2024-08-07T21:13:54.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0733
Vulnerability from cvelistv5
Published
2003-09-04 04:00
Modified
2024-08-08 02:05
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/8357 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:05:12.198Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "8357",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8357"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-08-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T16:36:24",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "8357",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8357"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0733",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "8357",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8357"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0733",
"datePublished": "2003-09-04T04:00:00",
"dateReserved": "2003-09-03T00:00:00",
"dateUpdated": "2024-08-08T02:05:12.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0409
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/203 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/38501 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.021Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-136.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/203"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38501",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38501"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-136.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/203"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38501",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38501"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-136.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/203"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38501",
"refsource": "OSVDB",
"url": "http://osvdb.org/38501"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0409",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2470
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26464 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/188 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.764Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-custom-jdbc-insecure(26464)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26464"
},
{
"name": "BEA06-126.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/188"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-custom-jdbc-insecure(26464)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26464"
},
{
"name": "BEA06-126.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/188"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2470",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-custom-jdbc-insecure(26464)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26464"
},
{
"name": "BEA06-126.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/188"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2470",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0682
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:28
Severity ?
EPSS score ?
Summary
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet.
References
| ▼ | URL | Tags |
|---|---|---|
| http://developer.bea.com/alerts/security_000731.html | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.osvdb.org/1481 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/1518 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:28:40.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"name": "1481",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/1481"
},
{
"name": "1518",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1518"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2004-09-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"name": "1481",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/1481"
},
{
"name": "1518",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1518"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0682",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://developer.bea.com/alerts/security_000731.html",
"refsource": "CONFIRM",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000728 BEA\u0027s WebLogic force handlers show code vulnerability",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"name": "1481",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/1481"
},
{
"name": "1518",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1518"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0682",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-09-19T00:00:00",
"dateUpdated": "2024-08-08T05:28:40.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4618
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/26539 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/38517 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/3008 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36321 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/247 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.818Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "38517",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38517"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "weblogic-headers-dos(36321)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36321"
},
{
"name": "BEA07-148.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/247"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-08-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "38517",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38517"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "weblogic-headers-dos(36321)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36321"
},
{
"name": "BEA07-148.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/247"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4618",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "26539",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26539"
},
{
"name": "38517",
"refsource": "OSVDB",
"url": "http://osvdb.org/38517"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-3008",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "weblogic-headers-dos(36321)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36321"
},
{
"name": "BEA07-148.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/247"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4618",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2695
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/274 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/36074 | vdb-entry, x_refsource_OSVDB | |
| http://dev2dev.bea.com/pub/advisory/227 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.548Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-159.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/274"
},
{
"name": "weblogic-servlet-unauthorized-access(34282)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34282"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "36074",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36074"
},
{
"name": "BEA07-159.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/227"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process \"external requests on behalf of a system identity,\" which allows remote attackers to access administrative data or functionality."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-159.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/274"
},
{
"name": "weblogic-servlet-unauthorized-access(34282)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34282"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "36074",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36074"
},
{
"name": "BEA07-159.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/227"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2695",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process \"external requests on behalf of a system identity,\" which allows remote attackers to access administrative data or functionality."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-159.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/274"
},
{
"name": "weblogic-servlet-unauthorized-access(34282)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34282"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "36074",
"refsource": "OSVDB",
"url": "http://osvdb.org/36074"
},
{
"name": "BEA07-159.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/227"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2695",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0410
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/204 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/38502 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-137.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/204"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38502",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38502"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified \"sequences of events.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-137.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/204"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38502",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38502"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0410",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified \"sequences of events.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-137.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/204"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "38502",
"refsource": "OSVDB",
"url": "http://osvdb.org/38502"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0410",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2462
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/195 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26458 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1016103 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-133.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/195"
},
{
"name": "weblogic-jta-transactions-disclosure(26458)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26458"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016103",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016103"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-133.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/195"
},
{
"name": "weblogic-jta-transactions-disclosure(26458)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26458"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016103",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016103"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2462",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-133.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/195"
},
{
"name": "weblogic-jta-transactions-disclosure(26458)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26458"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016103",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016103"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2462",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1757
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 01:00
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/10728 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.kb.cert.org/vuls/id/350350 | third-party-advisory, x_refsource_CERT-VN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/14957 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/9501 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:00:37.233Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "10728",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10728"
},
{
"name": "VU#350350",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/350350"
},
{
"name": "weblogic-boot-password-disclosure(14957)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14957"
},
{
"name": "9501",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9501"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "10728",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10728"
},
{
"name": "VU#350350",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/350350"
},
{
"name": "weblogic-boot-password-disclosure(14957)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14957"
},
{
"name": "9501",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9501"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1757",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "10728",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10728"
},
{
"name": "VU#350350",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/350350"
},
{
"name": "weblogic-boot-password-disclosure(14957)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14957"
},
{
"name": "9501",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9501"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1757",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T01:00:37.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0424
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/168 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24295 | vdb-entry, x_refsource_XF | |
| http://www.osvdb.org/22776 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.451Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA06-111.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/168"
},
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-server-log-disclosure(24295)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24295"
},
{
"name": "22776",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22776"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA06-111.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/168"
},
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-server-log-disclosure(24295)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24295"
},
{
"name": "22776",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22776"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0424",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA06-111.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/168"
},
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "weblogic-server-log-disclosure(24295)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24295"
},
{
"name": "22776",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22776"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0424",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2701
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue."
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/234 | vendor-advisory, x_refsource_BEA | |
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34287 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/36067 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA07-165.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/234"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jmsmessagebridge-security-bypass(34287)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34287"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36067",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36067"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and \"send unauthorized messages to a protected queue.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA07-165.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/234"
},
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jmsmessagebridge-security-bypass(34287)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34287"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36067",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36067"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2701",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and \"send unauthorized messages to a protected queue.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA07-165.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/234"
},
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jmsmessagebridge-security-bypass(34287)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34287"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"name": "36067",
"refsource": "OSVDB",
"url": "http://osvdb.org/36067"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2701",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4766
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 17:29
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/157 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:22.197Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-103.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/157"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-103.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/157"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4766",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-103.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/157"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4766",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T17:29:12.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0426
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://www.osvdb.org/22775 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24290 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/170 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.679Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22775",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22775"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-password-information-disclosure(24290)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24290"
},
{
"name": "BEA06-113.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/170"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22775",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22775"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-password-information-disclosure(24290)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24290"
},
{
"name": "BEA06-113.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/170"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0426",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "22775",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22775"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-password-information-disclosure(24290)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24290"
},
{
"name": "BEA06-113.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/170"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0426",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1758
Vulnerability from cvelistv5
Published
2005-03-10 05:00
Modified
2024-08-08 01:00
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1009764 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp | x_refsource_CONFIRM | |
| http://www.kb.cert.org/vuls/id/920238 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.osvdb.org/5297 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/10131 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/11357 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15860 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:00:37.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1009764",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1009764"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp"
},
{
"name": "VU#920238",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/920238"
},
{
"name": "5297",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/5297"
},
{
"name": "10131",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10131"
},
{
"name": "11357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11357"
},
{
"name": "bea-configxml-plaintext-password(15860)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1009764",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1009764"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp"
},
{
"name": "VU#920238",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/920238"
},
{
"name": "5297",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/5297"
},
{
"name": "10131",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10131"
},
{
"name": "11357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11357"
},
{
"name": "bea-configxml-plaintext-password(15860)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1758",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1009764",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1009764"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp"
},
{
"name": "VU#920238",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/920238"
},
{
"name": "5297",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/5297"
},
{
"name": "10131",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10131"
},
{
"name": "11357",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11357"
},
{
"name": "bea-configxml-plaintext-password(15860)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1758",
"datePublished": "2005-03-10T05:00:00",
"dateReserved": "2005-03-10T00:00:00",
"dateUpdated": "2024-08-08T01:00:37.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4761
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 17:47
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/152 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-98.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/152"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-98.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/152"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4761",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-98.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/152"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4761",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T17:47:51.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0412
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/206 | vendor-advisory, x_refsource_BEA | |
| http://osvdb.org/38505 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.163Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-139.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/206"
},
{
"name": "38505",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38505"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-139.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/206"
},
{
"name": "38505",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38505"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0412",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-139.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/206"
},
{
"name": "38505",
"refsource": "OSVDB",
"url": "http://osvdb.org/38505"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0412",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4750
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 22:36
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/138 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.074Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-87.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/138"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-87.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/138"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4750",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "BEA05-87.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/138"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4750",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T22:36:34.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4751
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-17 02:47
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/139 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.989Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-80.02",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/139"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-80.02",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/139"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4751",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-80.02",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/139"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4751",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-17T02:47:24.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0863
Vulnerability from cvelistv5
Published
2008-02-21 01:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1019455 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/260 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.101Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019455",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019455",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0863",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019455",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-187.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/260"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0863",
"datePublished": "2008-02-21T01:00:00",
"dateReserved": "2008-02-20T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2467
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26462 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1016099 | vdb-entry, x_refsource_SECTRACK | |
| http://securitytracker.com/id?1016097 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/191 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.529Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-console-ip-disclosure(26462)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26462"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016097"
},
{
"name": "BEA06-129.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/191"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-console-ip-disclosure(26462)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26462"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016097"
},
{
"name": "BEA06-129.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/191"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2467",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-console-ip-disclosure(26462)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26462"
},
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016099",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016099"
},
{
"name": "1016097",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016097"
},
{
"name": "BEA06-129.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/191"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2467",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4763
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 16:53
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/154 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.987Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-100.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/154"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-100.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/154"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4763",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-100.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/154"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4763",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T16:53:44.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4762
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 20:17
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/153 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.006Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-99.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/153"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-99.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/153"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4762",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-99.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/153"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4762",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T20:17:21.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1220
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/9034 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/25 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:46.064Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-39.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-39.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/25"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1220",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9034",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-39.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/25"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1220",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:46.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2461
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1016102 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/194 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26459 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.776Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016102",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016102"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-132.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/194"
},
{
"name": "weblogic-transaction-channel-insecure(26459)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26459"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016102",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016102"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-132.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/194"
},
{
"name": "weblogic-transaction-channel-insecure(26459)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26459"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2461",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016102",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016102"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-132.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/194"
},
{
"name": "weblogic-transaction-channel-insecure(26459)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26459"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2461",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2469
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/189 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1016098 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26463 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA06-127.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/189"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016098",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016098"
},
{
"name": "weblogic-server-log-password-cleartext(26463)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26463"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA06-127.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/189"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016098",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016098"
},
{
"name": "weblogic-server-log-password-cleartext(26463)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26463"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2469",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA06-127.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/189"
},
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016098",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016098"
},
{
"name": "weblogic-server-log-password-cleartext(26463)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26463"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2469",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2546
Vulnerability from cvelistv5
Published
2006-05-23 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1016101 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/193 | vendor-advisory, x_refsource_BEA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26460 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016101",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016101"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-131.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/193"
},
{
"name": "weblogic-admin-password-cleartext(26460)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26460"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016101",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016101"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-131.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/193"
},
{
"name": "weblogic-admin-password-cleartext(26460)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26460"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2546",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "1016101",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016101"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "BEA06-131.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/193"
},
{
"name": "weblogic-admin-password-cleartext(26460)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26460"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2546",
"datePublished": "2006-05-23T10:00:00",
"dateReserved": "2006-05-22T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2092
Vulnerability from cvelistv5
Published
2005-06-30 04:00
Modified
2024-08-07 22:15
Severity ?
EPSS score ?
Summary
BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1014366 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/42901 | vdb-entry, x_refsource_XF | |
| http://www.securiteam.com/securityreviews/5GP0220G0U.html | x_refsource_MISC | |
| http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf | x_refsource_MISC | |
| http://seclists.org/lists/bugtraq/2005/Jun/0025.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:15:37.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1014366",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014366"
},
{
"name": "bea-weblogic-hrs(42901)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42901"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securiteam.com/securityreviews/5GP0220G0U.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf"
},
{
"name": "20050606 A new whitepaper by Watchfire - HTTP Request Smuggling",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/lists/bugtraq/2005/Jun/0025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-06-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1014366",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014366"
},
{
"name": "bea-weblogic-hrs(42901)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42901"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securiteam.com/securityreviews/5GP0220G0U.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf"
},
{
"name": "20050606 A new whitepaper by Watchfire - HTTP Request Smuggling",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/lists/bugtraq/2005/Jun/0025.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2092",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1014366",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014366"
},
{
"name": "bea-weblogic-hrs(42901)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42901"
},
{
"name": "http://www.securiteam.com/securityreviews/5GP0220G0U.html",
"refsource": "MISC",
"url": "http://www.securiteam.com/securityreviews/5GP0220G0U.html"
},
{
"name": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf",
"refsource": "MISC",
"url": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf"
},
{
"name": "20050606 A new whitepaper by Watchfire - HTTP Request Smuggling",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/lists/bugtraq/2005/Jun/0025.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2092",
"datePublished": "2005-06-30T04:00:00",
"dateReserved": "2005-06-30T00:00:00",
"dateUpdated": "2024-08-07T22:15:37.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0419
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/213 | vendor-advisory, x_refsource_BEA | |
| http://osvdb.org/38513 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-146.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/213"
},
{
"name": "38513",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38513"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-146.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/213"
},
{
"name": "38513",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38513"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0419",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-146.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/213"
},
{
"name": "38513",
"refsource": "OSVDB",
"url": "http://osvdb.org/38513"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0419",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4760
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 23:20
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected."
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/151 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.984Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-97.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/151"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being \"fully protected.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-97.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/151"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4760",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being \"fully protected.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-97.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/151"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4760",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T23:20:59.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0895
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/265 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://www.securitytracker.com/id?1019443 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.067Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019443"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0895",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "BEA08-191.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "1019443",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019443"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0895",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1745
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/128 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2005/0605 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.229Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-78.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/128"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "ADV-2005-0605",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0605"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-78.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/128"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "ADV-2005-0605",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0605"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1745",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-78.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/128"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "ADV-2005-0605",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0605"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1745",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4705
Vulnerability from cvelistv5
Published
2006-02-01 20:00
Modified
2024-08-07 23:53
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/141 | vendor-advisory, x_refsource_BEA | |
| http://www.osvdb.org/20095 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.605Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-86.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/141"
},
{
"name": "20095",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20095"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-86.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/141"
},
{
"name": "20095",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20095"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-86.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/141"
},
{
"name": "20095",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20095"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4705",
"datePublished": "2006-02-01T20:00:00",
"dateReserved": "2006-02-01T00:00:00",
"dateUpdated": "2024-08-07T23:53:28.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0685
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:28
Severity ?
EPSS score ?
Summary
BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://developer.bea.com/alerts/security_000731.html | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/1525 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:28:41.493Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-07-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0685",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://developer.bea.com/alerts/security_000731.html",
"refsource": "CONFIRM",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1525"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0685",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-09-19T00:00:00",
"dateUpdated": "2024-08-08T05:28:41.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0422
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/32858 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/217 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.284Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "32858",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32858"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-150.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/217"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "32858",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32858"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-150.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/217"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0422",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "32858",
"refsource": "OSVDB",
"url": "http://osvdb.org/32858"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-150.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/217"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0422",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4704
Vulnerability from cvelistv5
Published
2006-02-01 20:00
Modified
2024-08-07 23:53
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/140 | vendor-advisory, x_refsource_BEA | |
| http://www.osvdb.org/20094 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.515Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-85.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/140"
},
{
"name": "20094",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20094"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-85.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/140"
},
{
"name": "20094",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20094"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-85.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/140"
},
{
"name": "20094",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20094"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4704",
"datePublished": "2006-02-01T20:00:00",
"dateReserved": "2006-02-01T00:00:00",
"dateUpdated": "2024-08-07T23:53:28.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4616
Vulnerability from cvelistv5
Published
2007-08-31 00:00
Modified
2024-08-07 15:01
Severity ?
EPSS score ?
Summary
The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/26539 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36320 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/25472 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1018620 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2007/3008 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/245 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:01:09.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "weblogic-nullcipher-information-disclosure(36320)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36320"
},
{
"name": "25472",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "1018620",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018620"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "BEA07-176.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/245"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-08-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "26539",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26539"
},
{
"name": "weblogic-nullcipher-information-disclosure(36320)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36320"
},
{
"name": "25472",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "1018620",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018620"
},
{
"name": "ADV-2007-3008",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "BEA07-176.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/245"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4616",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "26539",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26539"
},
{
"name": "weblogic-nullcipher-information-disclosure(36320)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36320"
},
{
"name": "25472",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/25472"
},
{
"name": "1018620",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018620"
},
{
"name": "ADV-2007-3008",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"name": "BEA07-176.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/245"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4616",
"datePublished": "2007-08-31T00:00:00",
"dateReserved": "2007-08-30T00:00:00",
"dateUpdated": "2024-08-07T15:01:09.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0899
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1019448 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/269 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019448",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0899",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019448",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-195.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/269"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0899",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0408
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/202 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38500 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1017519 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.977Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-135.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/202"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38500",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38500"
},
{
"name": "1017519",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017519"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-135.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/202"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38500",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38500"
},
{
"name": "1017519",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017519"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0408",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-135.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/202"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38500",
"refsource": "OSVDB",
"url": "http://osvdb.org/38500"
},
{
"name": "1017519",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017519"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0408",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1747
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.068Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (1)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111695921212456\u0026w=2"
},
{
"name": "BEA05-80.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/130"
},
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0101] BEA WebLogic Administration Console login page cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111722380313416\u0026w=2"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "ADV-2005-0607",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0607"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (2)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111695844803328\u0026w=2"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0100] BEA WebLogic Administration Console error page cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111722298705561\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (1)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111695921212456\u0026w=2"
},
{
"name": "BEA05-80.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/130"
},
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0101] BEA WebLogic Administration Console login page cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111722380313416\u0026w=2"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "ADV-2005-0607",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0607"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (2)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111695844803328\u0026w=2"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0100] BEA WebLogic Administration Console error page cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111722298705561\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1747",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html",
"refsource": "MISC",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (1)",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111695921212456\u0026w=2"
},
{
"name": "BEA05-80.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/130"
},
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0101] BEA WebLogic Administration Console login page cross-site scripting vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111722380313416\u0026w=2"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "ADV-2005-0607",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0607"
},
{
"name": "20050524 ACROS Security: HTML Injection in BEA WebLogic Server Console (2)",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111695844803328\u0026w=2"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"name": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html",
"refsource": "MISC",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html"
},
{
"name": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt",
"refsource": "MISC",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt"
},
{
"name": "20050527 [AppSecInc Advisory BEA05-V0100] BEA WebLogic Administration Console error page cross-site scripting vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111722298705561\u0026w=2"
},
{
"name": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt",
"refsource": "MISC",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1747",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0471
Vulnerability from cvelistv5
Published
2004-05-20 04:00
Modified
2024-08-08 00:17
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1010129 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/10327 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp | x_refsource_CONFIRM | |
| http://www.osvdb.org/6077 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16121 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/11594 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:17:15.027Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1010129",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010129"
},
{
"name": "10327",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10327"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp"
},
{
"name": "6077",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/6077"
},
{
"name": "weblogic-server-policy-bypass(16121)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16121"
},
{
"name": "11594",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11594"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-05-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1010129",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010129"
},
{
"name": "10327",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10327"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp"
},
{
"name": "6077",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/6077"
},
{
"name": "weblogic-server-policy-bypass(16121)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16121"
},
{
"name": "11594",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11594"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0471",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1010129",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010129"
},
{
"name": "10327",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10327"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp"
},
{
"name": "6077",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/6077"
},
{
"name": "weblogic-server-policy-bypass(16121)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16121"
},
{
"name": "11594",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11594"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0471",
"datePublished": "2004-05-20T04:00:00",
"dateReserved": "2004-05-13T00:00:00",
"dateUpdated": "2024-08-08T00:17:15.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-2177
Vulnerability from cvelistv5
Published
2005-11-16 21:17
Modified
2024-08-08 03:51
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/38 | vendor-advisory, x_refsource_BEA | |
| http://www.iss.net/security_center/static/10221.php | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/5819 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:51:17.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA02-20.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/38"
},
{
"name": "weblogic-http-response-information(10221)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/10221.php"
},
{
"name": "5819",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5819"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-09-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA02-20.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/38"
},
{
"name": "weblogic-http-response-information(10221)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/10221.php"
},
{
"name": "5819",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5819"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-2177",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA02-20.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/38"
},
{
"name": "weblogic-http-response-information(10221)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/10221.php"
},
{
"name": "5819",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5819"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-2177",
"datePublished": "2005-11-16T21:17:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-08T03:51:17.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0414
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/208 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/38506 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.975Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-141.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/208"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38506"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-141.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/208"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38506"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0414",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "BEA07-141.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/208"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "38506",
"refsource": "OSVDB",
"url": "http://osvdb.org/38506"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0414",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1225
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7563 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/22 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:46.065Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1225",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7563",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "BEA03-30.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1225",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:46.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0898
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id?1019447 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/268 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:40.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1019447",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0898",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1019447",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"name": "BEA08-194.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/268"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0898",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:40.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0684
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:28
Severity ?
EPSS score ?
Summary
BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://developer.bea.com/alerts/security_000731.html | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/1525 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:28:41.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-07-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0684",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://developer.bea.com/alerts/security_000731.html",
"refsource": "CONFIRM",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"name": "20000731 BEA\u0027s WebLogic *.jsp/*.jhtml remote command execution",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"name": "1525",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1525"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0684",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-09-19T00:00:00",
"dateUpdated": "2024-08-08T05:28:41.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1352
Vulnerability from cvelistv5
Published
2006-03-22 01:00
Modified
2024-08-07 17:12
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/183 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/17167 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25348 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1015790 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/19310 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1021 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:12:20.556Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA06-123.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/183"
},
{
"name": "17167",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17167"
},
{
"name": "weblogic-xml-parser-dos(25348)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25348"
},
{
"name": "1015790",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015790"
},
{
"name": "19310",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1021"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-03-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA06-123.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/183"
},
{
"name": "17167",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17167"
},
{
"name": "weblogic-xml-parser-dos(25348)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25348"
},
{
"name": "1015790",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015790"
},
{
"name": "19310",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1021"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA06-123.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/183"
},
{
"name": "17167",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17167"
},
{
"name": "weblogic-xml-parser-dos(25348)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25348"
},
{
"name": "1015790",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015790"
},
{
"name": "19310",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19310"
},
{
"name": "ADV-2006-1021",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1021"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1352",
"datePublished": "2006-03-22T01:00:00",
"dateReserved": "2006-03-21T00:00:00",
"dateUpdated": "2024-08-07T17:12:20.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4752
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 16:17
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/142 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA05-88.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/142"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA05-88.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/142"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4752",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
},
{
"name": "BEA05-88.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/142"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4752",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T16:17:28.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0652
Vulnerability from cvelistv5
Published
2004-07-13 04:00
Modified
2024-08-08 00:24
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/10133 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp | x_refsource_CONFIRM | |
| http://www.osvdb.org/5296 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1009766 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15865 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/11359 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.kb.cert.org/vuls/id/352110 | third-party-advisory, x_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:24:26.964Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "10133",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10133"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp"
},
{
"name": "5296",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/5296"
},
{
"name": "1009766",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1009766"
},
{
"name": "bea-gain-privileges(15865)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15865"
},
{
"name": "11359",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11359"
},
{
"name": "VU#352110",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/352110"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "10133",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10133"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp"
},
{
"name": "5296",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/5296"
},
{
"name": "1009766",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1009766"
},
{
"name": "bea-gain-privileges(15865)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15865"
},
{
"name": "11359",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11359"
},
{
"name": "VU#352110",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/352110"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0652",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "10133",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10133"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp"
},
{
"name": "5296",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/5296"
},
{
"name": "1009766",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1009766"
},
{
"name": "bea-gain-privileges(15865)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15865"
},
{
"name": "11359",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11359"
},
{
"name": "VU#352110",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/352110"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0652",
"datePublished": "2004-07-13T04:00:00",
"dateReserved": "2004-07-09T00:00:00",
"dateUpdated": "2024-08-08T00:24:26.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2696
Vulnerability from cvelistv5
Published
2007-10-06 21:00
Modified
2024-08-08 01:36
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/11865 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16421 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1010493 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/10545 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/59 | vendor-advisory, x_refsource_BEA | |
| http://www.osvdb.org/7081 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:36:25.252Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "11865",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11865"
},
{
"name": "weblogic-unexpected-user-identity(16421)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16421"
},
{
"name": "1010493",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010493"
},
{
"name": "10545",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10545"
},
{
"name": "BEA04-62.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/59"
},
{
"name": "7081",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/7081"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-06-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an \"unexpected user identity\" to be used in an RMI call."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "11865",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11865"
},
{
"name": "weblogic-unexpected-user-identity(16421)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16421"
},
{
"name": "1010493",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010493"
},
{
"name": "10545",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10545"
},
{
"name": "BEA04-62.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/59"
},
{
"name": "7081",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/7081"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2696",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an \"unexpected user identity\" to be used in an RMI call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "11865",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11865"
},
{
"name": "weblogic-unexpected-user-identity(16421)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16421"
},
{
"name": "1010493",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010493"
},
{
"name": "10545",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10545"
},
{
"name": "BEA04-62.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/59"
},
{
"name": "7081",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/7081"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2696",
"datePublished": "2007-10-06T21:00:00",
"dateReserved": "2007-10-06T00:00:00",
"dateUpdated": "2024-08-08T01:36:25.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0713
Vulnerability from cvelistv5
Published
2004-07-21 04:00
Modified
2024-08-08 00:24
Severity ?
EPSS score ?
Summary
The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15928 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/10185 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp | x_refsource_CONFIRM | |
| http://www.kb.cert.org/vuls/id/658878 | third-party-advisory, x_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:24:27.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-ejb-object-deletion(15928)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15928"
},
{
"name": "10185",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10185"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp"
},
{
"name": "VU#658878",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/658878"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-ejb-object-deletion(15928)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15928"
},
{
"name": "10185",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10185"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp"
},
{
"name": "VU#658878",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/658878"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0713",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-ejb-object-deletion(15928)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15928"
},
{
"name": "10185",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10185"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp"
},
{
"name": "VU#658878",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/658878"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0713",
"datePublished": "2004-07-21T04:00:00",
"dateReserved": "2004-07-20T00:00:00",
"dateUpdated": "2024-08-08T00:24:27.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2321
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/14962 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/9505 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/1 | vendor-advisory, x_refsource_BEA | |
| http://www.securitytracker.com/alerts/2004/Jan/1008867.html | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:13.600Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-operator-gain-access(14962)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14962"
},
{
"name": "9505",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9505"
},
{
"name": "BEA04-49.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/1"
},
{
"name": "1008867",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008867.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-operator-gain-access(14962)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14962"
},
{
"name": "9505",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9505"
},
{
"name": "BEA04-49.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/1"
},
{
"name": "1008867",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008867.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2321",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-operator-gain-access(14962)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14962"
},
{
"name": "9505",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9505"
},
{
"name": "BEA04-49.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/1"
},
{
"name": "1008867",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008867.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2321",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T01:22:13.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-0897
Vulnerability from cvelistv5
Published
2008-02-22 21:00
Modified
2024-08-07 08:01
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/267 | vendor-advisory, x_refsource_BEA | |
| http://www.securitytracker.com/id?1019444 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/29041 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/0612/references | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:01:39.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-02-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-03-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA08-193.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-0897",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA08-193.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"name": "1019444",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"name": "29041",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29041"
},
{
"name": "ADV-2008-0612",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-0897",
"datePublished": "2008-02-22T21:00:00",
"dateReserved": "2008-02-22T00:00:00",
"dateUpdated": "2024-08-07T08:01:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0417
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/38511 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/211 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.968Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38511",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38511"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-144.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/211"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "38511",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38511"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-144.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/211"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0417",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38511",
"refsource": "OSVDB",
"url": "http://osvdb.org/38511"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-144.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/211"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0417",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1223
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port, as demonstrated by nmap.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/9034 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/48 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:45.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-42.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/48"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager\u0027s port, as demonstrated by nmap."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-42.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/48"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1223",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager\u0027s port, as demonstrated by nmap."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9034",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-42.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/48"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1223",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:45.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0420
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/164 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-106.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/164"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause \"looping stack overflow errors.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-106.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/164"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0420",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause \"looping stack overflow errors.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "BEA06-106.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/164"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0420",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0415
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/38509 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/209 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.303Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38509",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38509"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-142.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/209"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "38509",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38509"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-142.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/209"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0415",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38509",
"refsource": "OSVDB",
"url": "http://osvdb.org/38509"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "BEA07-142.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/209"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0415",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0622
Vulnerability from cvelistv5
Published
2003-11-05 05:00
Modified
2024-08-08 01:58
Severity ?
EPSS score ?
Summary
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=106762000607681&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/13560 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/8931 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:58:11.126Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"name": "bea-tuxedo-device-dos(13560)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13560"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"name": "bea-tuxedo-device-dos(13560)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13560"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/8931"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20031031 Corsaire Security Advisory: BEA Tuxedo Administration CGI multiple argument issues",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"name": "bea-tuxedo-device-dos(13560)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13560"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"name": "8931",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/8931"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0622",
"datePublished": "2003-11-05T05:00:00",
"dateReserved": "2003-07-31T00:00:00",
"dateUpdated": "2024-08-08T01:58:11.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0151
Vulnerability from cvelistv5
Published
2003-03-21 05:00
Modified
2024-08-08 01:43
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=104792477914620&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/7124 | vdb-entry, x_refsource_BID | |
| http://www.s21sec.com/en/avisos/s21sec-011-en.txt | x_refsource_MISC | |
| http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp | x_refsource_CONFIRM | |
| http://marc.info/?l=bugtraq&m=104792544515384&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/7122 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:43:35.889Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20030317 SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104792477914620\u0026w=2"
},
{
"name": "7124",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7124"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp"
},
{
"name": "20030317 S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104792544515384\u0026w=2"
},
{
"name": "7122",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7122"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-03-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20030317 SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104792477914620\u0026w=2"
},
{
"name": "7124",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7124"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp"
},
{
"name": "20030317 S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104792544515384\u0026w=2"
},
{
"name": "7122",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7122"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0151",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20030317 SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=104792477914620\u0026w=2"
},
{
"name": "7124",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7124"
},
{
"name": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt",
"refsource": "MISC",
"url": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt"
},
{
"name": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp",
"refsource": "CONFIRM",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp"
},
{
"name": "20030317 S21SEC-011 - Multiple vulnerabilities in BEA WebLogic Server",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=104792544515384\u0026w=2"
},
{
"name": "7122",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7122"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0151",
"datePublished": "2003-03-21T05:00:00",
"dateReserved": "2003-03-18T00:00:00",
"dateUpdated": "2024-08-08T01:43:35.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2464
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/181 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26467 | vdb-entry, x_refsource_XF | |
| http://securitytracker.com/id?1016094 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.729Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-121.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/181"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-stopweblogic-password-disclosure(26467)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26467"
},
{
"name": "1016094",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016094"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-121.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/181"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-stopweblogic-password-disclosure(26467)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26467"
},
{
"name": "1016094",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016094"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2464",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "BEA06-121.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/181"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "weblogic-stopweblogic-password-disclosure(26467)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26467"
},
{
"name": "1016094",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016094"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2464",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1742
Vulnerability from cvelistv5
Published
2005-05-24 04:00
Modified
2024-08-07 21:59
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15486 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/0602 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1014049 | vdb-entry, x_refsource_SECTRACK | |
| http://dev2dev.bea.com/pub/advisory/125 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/13717 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:59:24.278Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0602",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0602"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-75.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/125"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13717"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-05-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to \"shrink or reset JDBC connection pools.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15486",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0602",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0602"
},
{
"name": "1014049",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-75.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/125"
},
{
"name": "13717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13717"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1742",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to \"shrink or reset JDBC connection pools.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15486",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15486"
},
{
"name": "ADV-2005-0602",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0602"
},
{
"name": "1014049",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014049"
},
{
"name": "BEA05-75.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/125"
},
{
"name": "13717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13717"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1742",
"datePublished": "2005-05-24T04:00:00",
"dateReserved": "2005-05-25T00:00:00",
"dateUpdated": "2024-08-07T21:59:24.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-0681
Vulnerability from cvelistv5
Published
2000-10-13 04:00
Modified
2024-08-08 05:28
Severity ?
EPSS score ?
Summary
Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/1570 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:28:41.296Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20000815 BEA Weblogic server proxy library vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html"
},
{
"name": "1570",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/1570"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-02T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20000815 BEA Weblogic server proxy library vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html"
},
{
"name": "1570",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/1570"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-0681",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20000815 BEA Weblogic server proxy library vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html"
},
{
"name": "1570",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/1570"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-0681",
"datePublished": "2000-10-13T04:00:00",
"dateReserved": "2000-09-19T00:00:00",
"dateUpdated": "2024-08-08T05:28:41.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4749
Vulnerability from cvelistv5
Published
2006-04-01 02:00
Modified
2024-09-16 22:15
Severity ?
EPSS score ?
Summary
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/159 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/17163 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/177 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/15052 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17138 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:29.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA05-105.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/159"
},
{
"name": "17163",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17163"
},
{
"name": "BEA06-105.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/177"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-01T02:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA05-105.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/159"
},
{
"name": "17163",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17163"
},
{
"name": "BEA06-105.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/177"
},
{
"name": "15052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17138"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4749",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA05-105.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/159"
},
{
"name": "17163",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17163"
},
{
"name": "BEA06-105.01",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/177"
},
{
"name": "15052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"name": "17138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17138"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4749",
"datePublished": "2006-04-01T02:00:00Z",
"dateReserved": "2006-03-31T00:00:00Z",
"dateUpdated": "2024-09-16T22:15:42.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-3257
Vulnerability from cvelistv5
Published
2008-07-22 16:00
Modified
2024-08-07 09:28
Severity ?
EPSS score ?
Summary
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:41.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30273"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3257",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"name": "20080717 Bea Weblogic Apache Connector BOF / Remote Denial of Service PoC",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"name": "6089",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"name": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"name": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html",
"refsource": "CONFIRM",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"name": "31146",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31146"
},
{
"name": "30273",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"name": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html",
"refsource": "CONFIRM",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"name": "1020520",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"name": "oracle-weblogic-apacheconnector-bo(43885)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"name": "VU#716387",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"name": "ADV-2008-2145",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3257",
"datePublished": "2008-07-22T16:00:00",
"dateReserved": "2008-07-22T00:00:00",
"dateUpdated": "2024-08-07T09:28:41.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1226
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7563 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7587 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/22 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:45.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "7587",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7587"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7563",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "7587",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7587"
},
{
"name": "BEA03-30.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1226",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7563",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7563"
},
{
"name": "7587",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7587"
},
{
"name": "BEA03-30.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/22"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1226",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:45.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2696
Vulnerability from cvelistv5
Published
2007-05-16 01:00
Modified
2024-08-07 13:49
Severity ?
EPSS score ?
Summary
The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1018057 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/25284 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34284 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/228 | vendor-advisory, x_refsource_BEA | |
| http://osvdb.org/36073 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/1815 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:49:57.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jms-security-bypass(34284)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34284"
},
{
"name": "BEA07-160.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/228"
},
{
"name": "36073",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36073"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1018057",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jms-security-bypass(34284)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34284"
},
{
"name": "BEA07-160.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/228"
},
{
"name": "36073",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36073"
},
{
"name": "ADV-2007-1815",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2696",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1018057",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1018057"
},
{
"name": "25284",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25284"
},
{
"name": "weblogic-jms-security-bypass(34284)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34284"
},
{
"name": "BEA07-160.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/228"
},
{
"name": "36073",
"refsource": "OSVDB",
"url": "http://osvdb.org/36073"
},
{
"name": "ADV-2007-1815",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2696",
"datePublished": "2007-05-16T01:00:00",
"dateReserved": "2007-05-15T00:00:00",
"dateUpdated": "2024-08-07T13:49:57.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0411
Vulnerability from cvelistv5
Published
2007-01-23 00:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/38503 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1017525 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23750 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22082 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/0213 | vdb-entry, x_refsource_VUPEN | |
| http://dev2dev.bea.com/pub/advisory/205 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.987Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38503",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/38503"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-138.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/205"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-13T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "38503",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/38503"
},
{
"name": "1017525",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-138.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/205"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0411",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38503",
"refsource": "OSVDB",
"url": "http://osvdb.org/38503"
},
{
"name": "1017525",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017525"
},
{
"name": "23750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23750"
},
{
"name": "22082",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"name": "ADV-2007-0213",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"name": "BEA07-138.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/205"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0411",
"datePublished": "2007-01-23T00:00:00",
"dateReserved": "2007-01-22T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2424
Vulnerability from cvelistv5
Published
2005-08-18 04:00
Modified
2024-08-08 01:29
Severity ?
EPSS score ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/10544 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/7 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/11864 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/7076 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1010492 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16419 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:29:12.867Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "10544",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10544"
},
{
"name": "BEA04-61.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/7"
},
{
"name": "11864",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11864"
},
{
"name": "7076",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/7076"
},
{
"name": "1010492",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010492"
},
{
"name": "weblogic-ssl-dos(16419)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16419"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-06-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-11T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "10544",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10544"
},
{
"name": "BEA04-61.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/7"
},
{
"name": "11864",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11864"
},
{
"name": "7076",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/7076"
},
{
"name": "1010492",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010492"
},
{
"name": "weblogic-ssl-dos(16419)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16419"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2424",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "10544",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10544"
},
{
"name": "BEA04-61.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/7"
},
{
"name": "11864",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11864"
},
{
"name": "7076",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/7076"
},
{
"name": "1010492",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010492"
},
{
"name": "weblogic-ssl-dos(16419)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16419"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2424",
"datePublished": "2005-08-18T04:00:00",
"dateReserved": "2005-08-18T00:00:00",
"dateUpdated": "2024-08-08T01:29:12.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5576
Vulnerability from cvelistv5
Published
2007-10-18 21:00
Modified
2024-08-07 15:39
Severity ?
EPSS score ?
Summary
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/45478 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 | vdb-entry, x_refsource_XF | |
| http://dev2dev.bea.com/pub/advisory/226 | vendor-advisory, x_refsource_BEA | |
| http://www.vupen.com/english/advisories/2007/1813 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:39:13.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45478",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/45478"
},
{
"name": "weblogic-tuxedo-information-disclosure(34290)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34290"
},
{
"name": "BEA07-158.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/226"
},
{
"name": "ADV-2007-1813",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1813"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-05-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45478",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/45478"
},
{
"name": "weblogic-tuxedo-information-disclosure(34290)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34290"
},
{
"name": "BEA07-158.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/226"
},
{
"name": "ADV-2007-1813",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1813"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5576",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45478",
"refsource": "OSVDB",
"url": "http://osvdb.org/45478"
},
{
"name": "weblogic-tuxedo-information-disclosure(34290)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34290"
},
{
"name": "BEA07-158.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/226"
},
{
"name": "ADV-2007-1813",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1813"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5576",
"datePublished": "2007-10-18T21:00:00",
"dateReserved": "2007-10-18T00:00:00",
"dateUpdated": "2024-08-07T15:39:13.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2471
Vulnerability from cvelistv5
Published
2006-05-19 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain "server details" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev2dev.bea.com/pub/advisory/187 | vendor-advisory, x_refsource_BEA | |
| http://secunia.com/advisories/20130 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2006/1828 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1016096 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26465 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.536Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA06-125.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/187"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016096",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016096"
},
{
"name": "weblogic-internal-information-disclosure(26465)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26465"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain \"server details\" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA06-125.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/187"
},
{
"name": "20130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016096",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016096"
},
{
"name": "weblogic-internal-information-disclosure(26465)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26465"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2471",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain \"server details\" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA06-125.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/187"
},
{
"name": "20130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20130"
},
{
"name": "ADV-2006-1828",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"name": "1016096",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016096"
},
{
"name": "weblogic-internal-information-disclosure(26465)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26465"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2471",
"datePublished": "2006-05-19T10:00:00",
"dateReserved": "2006-05-19T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1438
Vulnerability from cvelistv5
Published
2007-10-23 01:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp | vendor-advisory, x_refsource_BEA | |
| http://www.securitytracker.com/id?1006018 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/6717 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/11221 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.597Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "BEA03-26.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp"
},
{
"name": "1006018",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1006018"
},
{
"name": "6717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/6717"
},
{
"name": "weblogic-clustered-race-condition(11221)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11221"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-01-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "BEA03-26.01",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp"
},
{
"name": "1006018",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1006018"
},
{
"name": "6717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/6717"
},
{
"name": "weblogic-clustered-race-condition(11221)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11221"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1438",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "BEA03-26.01",
"refsource": "BEA",
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp"
},
{
"name": "1006018",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1006018"
},
{
"name": "6717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/6717"
},
{
"name": "weblogic-clustered-race-condition(11221)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11221"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1438",
"datePublished": "2007-10-23T01:00:00",
"dateReserved": "2007-10-22T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1380
Vulnerability from cvelistv5
Published
2005-05-02 04:00
Modified
2024-08-07 21:51
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/15128 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/15895 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/20276 | vdb-entry, x_refsource_XF | |
| http://www.red-database-security.com/advisory/bea_css_in_admin_console.html | x_refsource_MISC | |
| http://securitytracker.com/alerts/2005/Apr/1013817.html | vdb-entry, x_refsource_SECTRACK | |
| http://marc.info/?l=bugtraq&m=111472745503010&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/13400 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:51:48.917Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15128",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15128"
},
{
"name": "15895",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/15895"
},
{
"name": "weblogic-jndiframesetaction-xss(20276)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20276"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html"
},
{
"name": "1013817",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/alerts/2005/Apr/1013817.html"
},
{
"name": "20050428 Cross Site Scripting in BEA Admin Console",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111472745503010\u0026w=2"
},
{
"name": "13400",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/13400"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-04-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15128",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15128"
},
{
"name": "15895",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/15895"
},
{
"name": "weblogic-jndiframesetaction-xss(20276)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20276"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html"
},
{
"name": "1013817",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/alerts/2005/Apr/1013817.html"
},
{
"name": "20050428 Cross Site Scripting in BEA Admin Console",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111472745503010\u0026w=2"
},
{
"name": "13400",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/13400"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1380",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15128",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15128"
},
{
"name": "15895",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/15895"
},
{
"name": "weblogic-jndiframesetaction-xss(20276)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20276"
},
{
"name": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html",
"refsource": "MISC",
"url": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html"
},
{
"name": "1013817",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/alerts/2005/Apr/1013817.html"
},
{
"name": "20050428 Cross Site Scripting in BEA Admin Console",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111472745503010\u0026w=2"
},
{
"name": "13400",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/13400"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1380",
"datePublished": "2005-05-02T04:00:00",
"dateReserved": "2005-05-02T00:00:00",
"dateUpdated": "2024-08-07T21:51:48.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-2142
Vulnerability from cvelistv5
Published
2005-11-16 21:17
Modified
2024-08-08 03:51
Severity ?
EPSS score ?
Summary
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.iss.net/security_center/static/10392.php | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/5971 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/3 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:51:17.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "weblogic-security-policy-ignored(10392)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/10392.php"
},
{
"name": "5971",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5971"
},
{
"name": "BEA02-22.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-10-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a \"/\" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "weblogic-security-policy-ignored(10392)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/10392.php"
},
{
"name": "5971",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5971"
},
{
"name": "BEA02-22.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-2142",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a \"/\" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "weblogic-security-policy-ignored(10392)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/10392.php"
},
{
"name": "5971",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5971"
},
{
"name": "BEA02-22.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-2142",
"datePublished": "2005-11-16T21:17:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-08T03:51:17.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1221
Vulnerability from cvelistv5
Published
2005-08-16 04:00
Modified
2024-08-08 02:19
Severity ?
EPSS score ?
Summary
BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/9034 | vdb-entry, x_refsource_BID | |
| http://dev2dev.bea.com/pub/advisory/32 | vendor-advisory, x_refsource_BEA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:19:46.066Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-40.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9034",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-40.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1221",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9034",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9034"
},
{
"name": "BEA03-40.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1221",
"datePublished": "2005-08-16T04:00:00",
"dateReserved": "2005-08-16T00:00:00",
"dateUpdated": "2024-08-08T02:19:46.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-0431
Vulnerability from cvelistv5
Published
2006-01-25 23:00
Modified
2024-08-07 16:34
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/0313 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1015528 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/18592 | third-party-advisory, x_refsource_SECUNIA | |
| http://dev2dev.bea.com/pub/advisory/175 | vendor-advisory, x_refsource_BEA | |
| http://www.securityfocus.com/bid/16358 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24302 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:34:14.660Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-118.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA",
"x_transferred"
],
"url": "http://dev2dev.bea.com/pub/advisory/175"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-ssl-identity-exposure(24302)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24302"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server\u0027s SSL identity via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-0313",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "1015528",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-118.00",
"tags": [
"vendor-advisory",
"x_refsource_BEA"
],
"url": "http://dev2dev.bea.com/pub/advisory/175"
},
{
"name": "16358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-ssl-identity-exposure(24302)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24302"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0431",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server\u0027s SSL identity via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-0313",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"name": "1015528",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015528"
},
{
"name": "18592",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18592"
},
{
"name": "BEA06-118.00",
"refsource": "BEA",
"url": "http://dev2dev.bea.com/pub/advisory/175"
},
{
"name": "16358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"name": "weblogic-ssl-identity-exposure(24302)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24302"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0431",
"datePublished": "2006-01-25T23:00:00",
"dateReserved": "2006-01-25T00:00:00",
"dateUpdated": "2024-08-07T16:34:14.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log."
},
{
"lang": "es",
"value": "BEA WebLogic Server 6.1 hasta 6.1 SP7, y 7.0 hasta 7.0 SP7 permite a atacantes remotos provocar denegaci\u00f3n de servicio (consumo de disco) a trav\u00e9s de respuestas que contienen cabeceras malformadas, lo cual provoca que una gran cantidad de datos sean escritos en el log del servidor."
}
],
"id": "CVE-2007-0421",
"lastModified": "2024-11-21T00:25:49.393",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/215"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/32859"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/215"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/32859"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | * | |
| bea | weblogic_server | * | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp7:*:*:*:*:*:*",
"matchCriteriaId": "EF661B48-86C2-4636-B526-0E960B25F7B4",
"versionEndIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp6:*:*:*:*:*:*",
"matchCriteriaId": "614F8329-684E-4B39-A318-33A8E21270FA",
"versionEndIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages."
},
{
"lang": "es",
"value": "BEA WebLogic Server 6.1 hasta 6.1 SP7, 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP5, y 9.0 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (cuelgue del servidor) mediante ciertas peticiones que causan que hilos multiplexados se bloqueen al procesar p\u00e1ginas de error."
}
],
"id": "CVE-2007-0414",
"lastModified": "2024-11-21T00:25:48.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/208"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38506"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/208"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-07-22 16:41
Modified
2024-11-21 00:48
Severity ?
Summary
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3FED57A9-CD22-48C6-AF7B-C361CA843283",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6E3A5C91-82C4-40B6-B8F2-C083AEF76723",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9500F620-FEFE-4CB7-A733-65E7372BD8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "76738B84-33DD-450B-90A2-B22B77D52857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:sp15:*:*:*:*:*:*",
"matchCriteriaId": "E951CB37-0BFA-48D3-A7FA-8B75A5FD7EB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "ABEA67C2-6CD7-49FB-9C18-B23045D272AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:sp1:*:*:*:*:*:*",
"matchCriteriaId": "F9EB3890-9D1F-4F5D-A124-ED109AD0669E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.2:sp2:*:*:*:*:*:*",
"matchCriteriaId": "77DF4FDA-D9FC-4B20-89BC-EF9D853644E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*",
"matchCriteriaId": "B2B4C4E8-2862-457F-BDCC-3F54B8F7AADE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*",
"matchCriteriaId": "47974FFB-1B28-492B-9A83-78AF16CF62CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*",
"matchCriteriaId": "6F27425D-1754-44AE-A4B5-F27D5FA6A052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*",
"matchCriteriaId": "034C62E6-3598-4D66-A0BD-8BD2E67048C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "EF96A26E-7284-43A0-BD6A-907E1029197D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "C8479B6C-464F-41BC-BF81-31EA74CEF4D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*",
"matchCriteriaId": "B08241CF-0F3D-44E2-8D72-4F98413933EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "703482E8-35A9-4A9F-A9FD-B0F8CEA4A404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "2B2BD55C-15DE-4D7B-9B5A-21016B7E2A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:apache_connector_in_weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6471A8E2-13B4-4506-89D0-86526394FD4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "40A16573-91F2-42AA-8201-AE2D5962C4E6",
"versionEndIncluding": "10.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after \"POST /.jsp\" in an HTTP request."
},
{
"lang": "es",
"value": "Desbordamiento de b\u00fafer basado en pila en Apache Connector (mod_wl) en Oracle WebLogic Server (anteriormente BEA Weblogic Server) 10.3 y anteriores, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una cadena larga HTTP, como se ha demostrado mediante una cadena despu\u00e9s del \"POST /.jsp\" en una petici\u00f3n HTTP. NOTA: es probable que esta vulnerabilidad se solape con el CVE-2008-2579 u otra vulnerabilidad revelada en los avisos de Oracle CPUJul2008."
}
],
"id": "CVE-2008-3257",
"lastModified": "2024-11-21T00:48:49.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-07-22T16:41:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31146"
},
{
"source": "cve@mitre.org",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"source": "cve@mitre.org",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"source": "cve@mitre.org",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/6089"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.attrition.org/pipermail/vim/2008-July/002036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/716387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/30273"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1020520"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2145/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43885"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/6089"
}
],
"sourceIdentifier": "cve@mitre.org",
"vendorComments": [
{
"comment": "Oracle has released a workaround for CVE-2008-3257. Information is available at:\n\nhttp://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html",
"lastModified": "2008-07-31T00:00:00",
"organization": "Oracle"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a ResourceAllocationException.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user\u0027s password when it throws a ResourceAllocationException."
}
],
"id": "CVE-2003-1093",
"lastModified": "2024-11-20T23:46:20.163",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/331937"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/6586"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/331937"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/6586"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11057"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-10-20 04:00
Modified
2024-11-20 23:45
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | liquid_data | 1.1 | |
| bea | weblogic_integration | 2.0 | |
| bea | weblogic_integration | 7.0 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:liquid_data:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "33A4F5FB-69A0-49D0-81D1-D831C3E7BE1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "075BB751-A3EF-40DB-8D9C-9F7FB49061C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AB49671-9D20-44B1-93DE-261AD900679E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application."
}
],
"id": "CVE-2003-0733",
"lastModified": "2024-11-20T23:45:24.093",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8357"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8357"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password."
}
],
"id": "CVE-2005-1745",
"lastModified": "2024-11-20T23:58:02.150",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/128"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0605"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/128"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0605"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information."
},
{
"lang": "es",
"value": "La secuencia de comandos (script) WLST generada por el comando configToScript en BEA WebLogic Express y WebLogic Server 9.0 y 9.1 no cifra determinados atributos en los ficheros de configuraci\u00f3n cuando crea un nuevo dominio, lo cual permite a usuarios remotos autenticados obtener informaci\u00f3n sensible."
}
],
"id": "CVE-2007-2700",
"lastModified": "2024-11-21T00:31:26.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/233"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36068"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/233"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36068"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34288"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-03-18 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp | ||
| cve@mitre.org | http://www.kb.cert.org/vuls/id/691153 | Patch, Third Party Advisory, US Government Resource | |
| cve@mitre.org | http://www.securityfocus.com/bid/7130 | Patch, Vendor Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/691153 | Patch, Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/7130 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using \"memory\" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate."
}
],
"id": "CVE-2003-1095",
"lastModified": "2024-11-20T23:46:20.440",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-03-18T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/691153"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/7130"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11555"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/691153"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/7130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11555"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user."
}
],
"id": "CVE-2003-1438",
"lastModified": "2024-11-20T23:47:09.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/6717"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1006018"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11221"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-26.01.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/6717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1006018"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11221"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/139 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/139 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors."
}
],
"id": "CVE-2005-4751",
"lastModified": "2024-11-21T00:05:05.643",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/139"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information."
}
],
"id": "CVE-2006-2468",
"lastModified": "2024-11-21T00:11:22.723",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/190"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016097"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016099"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26468"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/190"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016099"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26468"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security."
},
{
"lang": "es",
"value": "El entorno de ejecuci\u00f3n WSEE (WS-Security runtime) en BEA WebLogic Server 9.0 y 0.1 no verifican las credenciales cuando descifran mensajes del cliente, lo cual permite a atacantes remotos evitar la seguridad de la aplicaci\u00f3n."
}
],
"id": "CVE-2007-0416",
"lastModified": "2024-11-21T00:25:48.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/210"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38510"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/210"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-27 04:00
Modified
2024-11-20 23:49
Severity ?
Summary
The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in \"*\" as wildcards as if they were the legal \"/*\" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected."
},
{
"lang": "es",
"value": "La caracter\u00edstica de coincidencia de patrones en URL de WebLogic Server 6.x encuentra coincidencias en patrones ilegales terminados en \"*\" como comodines como si fueran el patr\u00f3n legal \"/\", lo que podr\u00eda causar que usuarios remotos se saltaran las restricciones de acceso pretendidas porque los patrones ilegales son rechazados adecuadamente."
}
],
"id": "CVE-2004-0711",
"lastModified": "2024-11-20T23:49:13.660",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-07-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/184558"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10184"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15927"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/184558"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10184"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15927"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to \"shrink or reset JDBC connection pools.\""
}
],
"id": "CVE-2005-1742",
"lastModified": "2024-11-20T23:58:01.700",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/125"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0602"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/125"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0602"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping).
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping)."
}
],
"id": "CVE-2005-1749",
"lastModified": "2024-11-20T23:58:02.790",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/132"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0609"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/132"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0609"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server."
},
{
"lang": "es",
"value": "El Servidor JMS en BEA WebLogic Server 6.1 hasta SP7, 7.0 hasta SP6, y 8.1 hasta SP5 hace cumplir pol\u00edticas de acceso de seguridad en la interfaz frontal (front end), lo cual permite a atacantes remotos acceder a colas protegidas mediante peticiones directas al servidor JMS interno (back-end server)."
}
],
"id": "CVE-2007-2696",
"lastModified": "2024-11-21T00:31:26.023",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/228"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36073"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36073"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34284"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-08-27 04:00
Modified
2024-11-20 23:45
Severity ?
Summary
BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "868143C0-88F3-47FB-8590-C0B60BE7970D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:express:*:*:*:*:*",
"matchCriteriaId": "5B0C63A5-F105-4D03-BD2E-B3AAD120A4BD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges."
},
{
"lang": "es",
"value": "BEA WebLogic Server y Express, cuando usa NodeManager para iniciar servidores, provee al usuarios Operadores con privilegios para sobreesctibir nombres de usuario y contrase\u00f1as, lo que puede permitir a Operadores ganar privielgios de Admin."
}
],
"id": "CVE-2003-0640",
"lastModified": "2024-11-20T23:45:12.380",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-08-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.secunia.com/advisories/9232/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.secunia.com/advisories/9232/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-10-20 04:00
Modified
2024-11-20 23:33
Severity ?
Summary
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:express:*:*:*:*:*",
"matchCriteriaId": "16324B74-4143-473D-858F-B5B1899822B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:express:*:*:*:*:*",
"matchCriteriaId": "DFA4200B-3877-4FC9-B2AB-E51675CAD71F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:express:*:*:*:*:*",
"matchCriteriaId": "B1C2B98A-EF68-4569-B50C-8F21D2298435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "9B6656CF-65ED-4F8E-B9F2-75A9DC1571D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "7C013AE2-4B06-437A-815F-FAADD28CFA85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:express:*:*:*:*:*",
"matchCriteriaId": "D7306C09-BFBA-4DC0-8EA1-E5A5C0BC080F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet."
}
],
"id": "CVE-2000-0683",
"lastModified": "2024-11-20T23:33:03.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"source": "cve@mitre.org",
"url": "http://developer.bea.com/alerts/security_000728.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/1480"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1517"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://developer.bea.com/alerts/security_000728.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/1480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1517"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "651994FC-395B-4268-B976-281B8A34957E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "E800B227-C828-48CA-B5EF-F315823CD30F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "56476419-F51B-465C-8BA8-529C59123351",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "B23822A2-0B53-4CCC-B62B-8CE48B23F745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "A19E505D-C095-4266-83C6-414454FB30E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted."
}
],
"id": "CVE-2006-0427",
"lastModified": "2024-11-21T00:06:26.413",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/171"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22774"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24291"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/171"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22774"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24291"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-01 05:00
Modified
2024-11-20 23:45
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 3.1.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D64DB9FA-A1CF-4D6C-8798-9F067E3B8733",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de scripts en sitios cruzados en Interactive.jsp de BEA WebLogic 8.1 y anteriores permite a atacantes remotos inyectar script web malicioso mediante el par\u00e1metro person."
}
],
"id": "CVE-2003-0624",
"lastModified": "2024-11-20T23:45:10.067",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2003-12-01T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=106761926906781\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8938"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13568"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=106761926906781\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8938"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13568"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-23 10:06
Modified
2024-11-21 00:11
Severity ?
Summary
A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges."
}
],
"id": "CVE-2006-2546",
"lastModified": "2024-11-21T00:11:33.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-23T10:06:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/193"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016101"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26460"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/193"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016101"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26460"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-07 04:00
Modified
2024-11-20 23:48
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2, cuando se edita weblogic.xml usando WebLocic Builder o el m\u00e9todo SecurityRoleAssignmentMBean.toXML, quita de manera inadvertida etiquetas de asignaci\u00f3n de papel de seguridad cuando weblogic.xml no tiene una etiqueta de nombre principal, lo que puede eliminar las restricciones de acceso pretendidas para la aplicaci\u00f3n web asociada."
}
],
"id": "CVE-2004-0470",
"lastModified": "2024-11-20T23:48:39.283",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-07-07T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11593"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1010128"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/950070"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/6076"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/10328"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16123"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11593"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1010128"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/950070"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/6076"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/10328"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16123"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_server | 10.0_mp1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Server y Express de 6.1 a 10.0 MP1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de muestras no especificadas. NOTA: podr\u00eda ser la misma vulnerabilidad que CVE-2007-2694."
}
],
"id": "CVE-2008-0902",
"lastModified": "2024-11-21T00:43:11.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/273"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-03-24 05:00
Modified
2024-11-20 23:44
Severity ?
Summary
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code."
},
{
"lang": "es",
"value": "BEA Weblogic Server y Express 6.0 a 7.0 no restringe adecuadamente el acceso a ciertos servlets internos que llevan a cabo funciones administrativas, lo que permite a atacantes remotos leer ficheros arbitrarios o ejecutar c\u00f3digo arbitrario."
}
],
"id": "CVE-2003-0151",
"lastModified": "2024-11-20T23:44:05.883",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-03-24T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=104792477914620\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=104792544515384\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7122"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=104792477914620\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=104792544515384\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.s21sec.com/en/avisos/s21sec-011-en.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7122"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7124"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user\u0027s password by physically observing (\"shoulder surfing\") the screen."
}
],
"id": "CVE-2003-1224",
"lastModified": "2024-11-20T23:46:38.867",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL."
}
],
"id": "CVE-2003-1220",
"lastModified": "2024-11-20T23:46:38.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/25"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-08-06 04:00
Modified
2024-11-20 23:49
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLogic Express 7.0 a 7.0 Service Pack 4, y 8.1 a 8.1 Service Pack 2 permiten a atacantes obtener el nombre de usuario y contrase\u00f1a para arrancar el servidor accediendo directamente a ciertos m\u00e9todos internos."
}
],
"id": "CVE-2004-0652",
"lastModified": "2024-11-20T23:49:04.567",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-08-06T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11359"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1009766"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/352110"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/5296"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10133"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15865"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11359"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1009766"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/352110"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/5296"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10133"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15865"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-01 05:00
Modified
2024-11-20 23:45
Severity ?
Summary
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C2EF5B-C454-4BED-81F6-59FCC531D99F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4CB4D0B4-EF75-41BC-BD95-32DAA0BE4415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1719019F-64EB-432D-98DF-839F92C8ED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EC74F617-4CA9-4B0C-87C7-C49A73934CEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "95C77782-600F-4BBB-B71D-C28FDD9AAF60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "30BF1224-40A6-454F-B6CF-3BEEBE3272B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.2:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "87092B8D-8AF5-498C-9187-D64820CF218B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.0.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "D79F6858-4D7F-4EB3-BDB3-957AD6795ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument."
},
{
"lang": "es",
"value": "La consola de adminstraci\u00f3n de BEA Tuxedo 8.1 y anteriores permite a atacantes remotos determinar la existencia de ficheros fuera de la ra\u00edz web mediante rutas modificadas en el argumento INFILE."
}
],
"id": "CVE-2003-0621",
"lastModified": "2024-11-20T23:45:09.647",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-01T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13559"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13559"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLogic Express de 6.1 a 10.0 permite a atacantes remotos evitar la autentificaci\u00f3n para servlets de aplicaci\u00f3n a trav\u00e9s de cabeceras de petici\u00f3n modificadas."
}
],
"id": "CVE-2008-0895",
"lastModified": "2024-11-21T00:43:10.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019443"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019443"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:51
Severity ?
Summary
The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges."
}
],
"id": "CVE-2004-1755",
"lastModified": "2024-11-20T23:51:39.973",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/10725"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/858990"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9502"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15826"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/10725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/858990"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15826"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2001-02-12 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E27911BD-A0AE-46F4-BF7D-842E466715FB",
"versionEndIncluding": "4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a \"..\" string."
}
],
"id": "CVE-2001-0098",
"lastModified": "2024-11-20T23:34:35.750",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2001-02-12T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/2138"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5782"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-12/0331.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/2138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5782"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-07-13 22:30
Modified
2024-11-21 01:16
Severity ?
Summary
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea_systems | weblogic_server | 10.0 | |
| oracle | weblogic_server | 10.3.2.0.0 | |
| oracle | weblogic_server | 10.3.3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp3:*:*:*:*:*:*",
"matchCriteriaId": "73264312-A7AE-4974-A46D-70D8336A0B5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0:mp2:*:*:*:*:*:*",
"matchCriteriaId": "ADF4D7FE-55C5-4CBA-B75E-5A30E73AF402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:10.3.2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58B1DD57-050A-4A82-9E73-0C29DC22B581",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_server:10.3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "30D1EC44-6231-4710-B9FB-7551781814EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS."
},
{
"lang": "es",
"value": "Paquete/Privilegio: Plugins para Apache, Sun y servicios web IIS, vulnerabilidad no especificada en el componente WebLogic Server de Oracle Fusion Middleware v7.0 SP7, v8.1 SP6, v9.0, v9.1, v9.2 MP3, v10.0 MP2, v10.3.2 y v10.3.3, permite a atacantes remotos afectar la confidencialidad e integridad, relacionado con IIS."
}
],
"id": "CVE-2010-2375",
"lastModified": "2024-11-21T01:16:31.820",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-07-13T22:30:02.547",
"references": [
{
"source": "secalert_us@oracle.com",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
}
],
"sourceIdentifier": "secalert_us@oracle.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address."
}
],
"id": "CVE-2006-2467",
"lastModified": "2024-11-21T00:11:22.590",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/191"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016097"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016099"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26462"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/191"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016099"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26462"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port, as demonstrated by nmap.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager\u0027s port, as demonstrated by nmap."
}
],
"id": "CVE-2003-1223",
"lastModified": "2024-11-20T23:46:38.733",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/48"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/48"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and \"send unauthorized messages to a protected queue.\""
},
{
"lang": "es",
"value": "El JMS Message Bridge en BEA WebLogic Server 7.0 hasta SP7 y 8.1 hasta Service Pack 6, cuando es configurado sin un nombre de usuario y una contrase\u00f1a, o cuando la URL de conexi\u00f3n no esta definida, permite a atacantes remotos evitar la pol\u00edtica de acceso de seguridad y \"enviar mensajes sin autorizar a una cola protegida\"."
}
],
"evaluatorSolution": "The vendor has released a product update to address this issue: ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/CR281022_81sp6_rarfiles.jar",
"id": "CVE-2007-2701",
"lastModified": "2024-11-21T00:31:26.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/234"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36067"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34287"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/234"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36067"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34287"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins).
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/155 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/155 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "2B2BD55C-15DE-4D7B-9B5A-21016B7E2A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "C54D9244-D6EA-4AA6-94B4-15D232F1D6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:win32:*:*:*:*:*",
"matchCriteriaId": "8932DF57-EE6D-4291-9EA8-F6FC0C991F91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "5AB11D55-95CD-4CB1-B907-CBCFA2A1696A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "41FA5A13-C6AF-463F-B002-376E7C1EF850",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins)."
}
],
"id": "CVE-2005-4764",
"lastModified": "2024-11-21T00:05:07.553",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/155"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/155"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:express:*:*:*:*:*",
"matchCriteriaId": "B6C69891-E178-4D9E-898B-68A6A9DB3AEA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process \"external requests on behalf of a system identity,\" which allows remote attackers to access administrative data or functionality."
},
{
"lang": "es",
"value": "Los servlets HttpClusterServlet y HttpProxyServlet en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0, y 9.1, cuando SecureProxy est\u00e1 habitilitado, pueden procesar \"peticiones externas de parte de una identidad de sistema\", lo cual permite a atacantes remotos acceder a datos o funcionalidades de administraci\u00f3n."
}
],
"id": "CVE-2007-2695",
"lastModified": "2024-11-21T00:31:25.863",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/227"
},
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/274"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36074"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34282"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/227"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/274"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34282"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:04
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/141 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.osvdb.org/20095 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/141 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/20095 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection."
}
],
"id": "CVE-2005-4705",
"lastModified": "2024-11-21T00:04:58.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/141"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/20095"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/141"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/20095"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected."
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/151 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/151 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being \"fully protected.\""
}
],
"id": "CVE-2005-4760",
"lastModified": "2024-11-21T00:05:06.970",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/151"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/151"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:ga:*:*:*:*:*:*",
"matchCriteriaId": "C49ECE42-9507-4B84-8D78-45B6929CD23C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack."
},
{
"lang": "es",
"value": "BEA WebLogic Server 8.1 hasta 8.1 SP5, 9.0, 9.1, y 9.2 Gold, cuando WS-Security es utilizado, no valida certificados adecuadamente, lo cual permite a atacantes remotos llevar a cabo ataques de hombre en el medio (MITM, man-in-the-middle)."
}
],
"id": "CVE-2007-0411",
"lastModified": "2024-11-21T00:25:47.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/205"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38503"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/205"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38503"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends."
}
],
"id": "CVE-2004-2424",
"lastModified": "2024-11-20T23:53:19.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/7"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11864"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1010492"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7076"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/10544"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11864"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1010492"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7076"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/10544"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16419"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions."
},
{
"lang": "es",
"value": "BEA WebLogic Server 8.1 hasta 8.1 SP5 no fuerza adecuadamente el control de acceso tras una actualizaci\u00f3n din\u00e1mica y un redespliegue din\u00e1mico de una aplicaci\u00f3n que est\u00e1 implementada a trav\u00e9s de jars expandidos, lo cual permite a los atacantes evitar las restricciones de acceso pretendidas."
}
],
"id": "CVE-2007-0415",
"lastModified": "2024-11-21T00:25:48.487",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/209"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38509"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/209"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38509"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.1 does not properly handle propagation of an admin server\u0027s security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426."
},
{
"lang": "es",
"value": "BEA WebLogic Server 9.1 no maneja adecuadamente la propagaci\u00f3n del registro de cambios de la pol\u00edtica de seguridad del servidor de administraci\u00f3n a servidores temporalmente no disponibles para su administraci\u00f3n, lo que puede permitir a atacante evitar las restricciones planeadas. Vulnerabilidad diferente a la CVE-2007-0426."
}
],
"id": "CVE-2007-4614",
"lastModified": "2024-11-21T00:36:01.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/216"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/45839"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/216"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/45839"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22082"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions."
}
],
"id": "CVE-2005-1743",
"lastModified": "2024-11-20T23:58:01.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/126"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/126"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0603"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/159 | Patch, Vendor Advisory | |
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/177 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.securityfocus.com/bid/17163 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/159 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/177 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/17163 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors."
}
],
"id": "CVE-2005-4749",
"lastModified": "2024-11-21T00:05:05.327",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/159"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/177"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/17163"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/159"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/177"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/17163"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a \"timing window\" when a compilation error occurs, aka the \"JSP showcode vulnerability.\""
}
],
"id": "CVE-2006-2466",
"lastModified": "2024-11-21T00:11:22.457",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/192"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016100"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26461"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/192"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016100"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26461"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain "server details" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain \"server details\" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault."
}
],
"evaluatorSolution": "This vulnerability is addressed in the following product releases:\r\nBEA Systems, Weblogic Server, 8.1 SP 5\r\nBEA Systems, Weblogic Express, 8.1 SP 5\r\nBEA Systems, Weblogic Server, 7.0 SP 7\r\nBEA Systems, Weblogic Express, 7.0 SP 7\r\nBEA Systems, Weblogic Server, 6.1 SP 8\r\nBEA Systems, Weblogic Express, 6.1 SP 8",
"id": "CVE-2006-2471",
"lastModified": "2024-11-21T00:11:23.167",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/187"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016096"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26465"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/187"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016096"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26465"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information."
},
{
"lang": "es",
"value": "La Consola de Administraci\u00f3n en BEA WebLogic Server 9.0 puede mostrar los atributos del Servicio Web en texto plano durante la configuraci\u00f3n, lo cual permite a atacantes remotos obtener informaci\u00f3n credencial sensible."
}
],
"evaluatorSolution": "The vendor has issued product updates to addresses these issues:\r\n\r\nBEA WebLogic Server patches:\r\nhttp://commerce.bea.com/showallversions.jsp?family=WLS\r\n\r\nBEA WebLogic Platform patches:\r\nhttp://commerce.bea.com/showallversions.jsp?family=WLP",
"id": "CVE-2007-2698",
"lastModified": "2024-11-21T00:31:26.317",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/230"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36071"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/230"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36071"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34286"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-06-08 04:00
Modified
2024-11-20 23:32
Severity ?
Summary
The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm | Broken Link | |
| cve@mitre.org | http://developer.bea.com/alerts/security_000612.html | Broken Link | |
| cve@mitre.org | http://www.securityfocus.com/bid/1328 | Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/4694 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://developer.bea.com/alerts/security_000612.html | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/1328 | Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/4694 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:express:*:*:*:*:*",
"matchCriteriaId": "5B0C63A5-F105-4D03-BD2E-B3AAD120A4BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2664DE74-15B5-4502-AD51-FCB1C54A1B6B",
"versionEndIncluding": "4.5.1",
"versionStartIncluding": "3.1.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case."
}
],
"id": "CVE-2000-0499",
"lastModified": "2024-11-20T23:32:38.670",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2000-06-08T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://developer.bea.com/alerts/security_000612.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Exploit",
"Patch",
"Third Party Advisory",
"VDB Entry",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1328"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4694"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0262.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://developer.bea.com/alerts/security_000612.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Exploit",
"Patch",
"Third Party Advisory",
"VDB Entry",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1328"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4694"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-178"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-10-20 04:00
Modified
2024-11-20 23:33
Severity ?
Summary
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:express:*:*:*:*:*",
"matchCriteriaId": "16324B74-4143-473D-858F-B5B1899822B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:express:*:*:*:*:*",
"matchCriteriaId": "DFA4200B-3877-4FC9-B2AB-E51675CAD71F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:express:*:*:*:*:*",
"matchCriteriaId": "B1C2B98A-EF68-4569-B50C-8F21D2298435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "9B6656CF-65ED-4F8E-B9F2-75A9DC1571D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "7C013AE2-4B06-437A-815F-FAADD28CFA85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:express:*:*:*:*:*",
"matchCriteriaId": "D7306C09-BFBA-4DC0-8EA1-E5A5C0BC080F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet."
}
],
"id": "CVE-2000-0682",
"lastModified": "2024-11-20T23:33:03.367",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"source": "cve@mitre.org",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/1481"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1518"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/1481"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1518"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp4:*:*:*:*:*:*",
"matchCriteriaId": "694AF942-2D1E-4CB6-B9BE-AC1C2ACD7381",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate."
},
{
"lang": "es",
"value": "BEA Weblogic Server 8.1 hasta 8.1 SP4 no valida adecuadamente certificados cliente al reutilizar conexiones cacheadas, lo cual permite a atacantes remotos obtener acceso mediante un certificado X.509 que no es de confianza."
}
],
"id": "CVE-2007-0408",
"lastModified": "2024-11-21T00:25:47.353",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/202"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38500"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017519"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/202"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38500"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI).
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI)."
}
],
"id": "CVE-2003-1290",
"lastModified": "2024-11-20T23:46:47.830",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/162"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/10218"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18396"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3064"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16215"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13752"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/10218"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18396"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3064"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16215"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13752"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file."
},
{
"lang": "es",
"value": "BEA WebLogic Server versiones 8.1 hasta 8.1 SP5, almacena los datos en texto sin cifrar en una copia de seguridad del archivo config.xml despu\u00e9s de la edici\u00f3n offline, lo que permite a usuarios locales obtener informaci\u00f3n confidencial mediante la lectura de este archivo de copia de seguridad."
}
],
"id": "CVE-2007-0413",
"lastModified": "2024-11-21T00:25:48.153",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/207"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38504"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38504"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions."
}
],
"id": "CVE-2006-0429",
"lastModified": "2024-11-21T00:06:26.693",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/173"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22773"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24298"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/173"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22773"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24298"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies."
}
],
"id": "CVE-2005-1746",
"lastModified": "2024-11-20T23:58:02.307",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/129"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0606"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0606"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-18 21:17
Modified
2024-11-21 00:38
Severity ?
Summary
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "95C77782-600F-4BBB-B71D-C28FDD9AAF60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "30BF1224-40A6-454F-B6CF-3BEEBE3272B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "53E28DE8-4868-4DCE-8F8C-7967F2515D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "60231665-A976-4831-9419-AA332D3CC3D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "C67B3D8E-EBFF-4926-B696-9DC123A667EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "DA53F4D4-CABE-47A4-A900-840B5B933D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "4CE99F33-A818-441D-A4AF-773C5422D992",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "FC355584-B0B1-4834-B2C9-4671AC4ED382",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C64003CF-C562-491A-8430-B8D40CEC528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:express:*:*:*:*:*",
"matchCriteriaId": "B06BDF43-A534-4F38-813D-72F538549F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "AD6F9694-259F-4631-BC93-B1136F08E77E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "77624161-7740-4162-9C83-C0DFEA2BBCCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "E785D039-3426-4C1F-BBA8-7C6D32FB141E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "D4B2A474-B6C4-47B6-8B20-8722A8C25238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "2FDBD7AF-51AC-48B9-A465-0C13B9230EE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B04835B2-7FE9-462B-B989-4031D43C9670",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands."
},
{
"lang": "es",
"value": "BEA Tuxedo 8.0 anterior al RP392 y el 8.1 anterior al RP293 y el WebLogic Enterprise 5.1 anterior al RP174, muestra la contrase\u00f1a en texto claro, lo que permite a atacantes f\u00edsicamente pr\u00f3ximos obtener informaci\u00f3n sensible a trav\u00e9s de los comandos (1) cnsbind, (2) cnsunbind o (3) cnsls."
}
],
"evaluatorSolution": "More information can be found regarding patch information at:\r\nhttp://www.securityfocus.com/bid/23979/solution",
"id": "CVE-2007-5576",
"lastModified": "2024-11-21T00:38:13.363",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.1,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-10-18T21:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/226"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/45478"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1813"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34290"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/226"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/45478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34290"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member of a distributed queue, which allows remote authenticated users to bypass intended access restrictions for protected distributed queues."
},
{
"lang": "es",
"value": "La caracter\u00edstica de cola distribuida en JMS de BEA WebLogic Server de 9.0 a 10.0, en ciertas configuraciones, no manipula correctamente cuando un cliente no puede enviar un mensaje a un miembro de una cola distribuida, lo que permite a usuarios autentificados remotamente evitar las restricciones de acceso previstas para colas distribuidas protegidas."
}
],
"id": "CVE-2008-0898",
"lastModified": "2024-11-21T00:43:10.590",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/268"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:42
Severity ?
Summary
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_integration | 7.0 | |
| bea | weblogic_integration | 7.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AB49671-9D20-44B1-93DE-261AD900679E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_integration:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "F84AF19F-BC6C-4C4E-86E4-C4BA27A8A424",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a \"/\" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension."
}
],
"id": "CVE-2002-2142",
"lastModified": "2024-11-20T23:42:58.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/3"
},
{
"source": "cve@mitre.org",
"url": "http://www.iss.net/security_center/static/10392.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/5971"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.iss.net/security_center/static/10392.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/5971"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-06-21 04:00
Modified
2024-11-20 23:32
Severity ?
Summary
The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 3.1.8 | |
| bea | weblogic_server | 3.1.8 | |
| bea | weblogic_server | 4.0 | |
| bea | weblogic_server | 4.0 | |
| bea | weblogic_server | 4.5 | |
| bea | weblogic_server | 4.5 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:express:*:*:*:*:*",
"matchCriteriaId": "E8E13F70-AE6E-4443-B414-DAACD3F14355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3FED57A9-CD22-48C6-AF7B-C361CA843283",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0:*:express:*:*:*:*:*",
"matchCriteriaId": "292C88E7-3CD1-4D87-91B1-5E170A358E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9500F620-FEFE-4CB7-A733-65E7372BD8D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5:*:express:*:*:*:*:*",
"matchCriteriaId": "3AB46979-F303-4CAD-AF0F-997BD7CE724F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing."
}
],
"id": "CVE-2000-0500",
"lastModified": "2024-11-20T23:32:38.800",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-06-21T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=96161462915381\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1378"
},
{
"source": "cve@mitre.org",
"url": "http://www.weblogic.com/docs51/admindocs/http.html#file"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4775"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=96161462915381\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1378"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.weblogic.com/docs51/admindocs/http.html#file"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/4775"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies."
}
],
"id": "CVE-2006-2470",
"lastModified": "2024-11-21T00:11:23.010",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/188"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26464"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/188"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26464"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:ga:*:*:*:*:*:*",
"matchCriteriaId": "C49ECE42-9507-4B84-8D78-45B6929CD23C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests."
},
{
"lang": "es",
"value": "BEA WebLogic Server 9.0, 9.1, y 9.2 Gold permite a atacantes remotos obtener informaci\u00f3n sensible mediante peticiones HTTP mal formadas, lo cual revela datos de peticiones anteriores."
}
],
"id": "CVE-2007-0420",
"lastModified": "2024-11-21T00:25:49.247",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/214"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38514"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/214"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38514"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service."
},
{
"lang": "es",
"value": "El servidor LDAP embebido en BEA WebLogic Express y WebLogic Server 7.0 hasta SP6, 8.1 hasta SP5, 9.0, y 9.1, en configuraciones concretas, no limita o monitoriza intentos fallidos de autenticaci\u00f3n, lo cual permite a atacantes remotos llevar a cabo ataques de fuerza bruta contra la contrase\u00f1a del administrador m\u00e1s f\u00e1cilmente, o inundar el servidor con intentos de identificaci\u00f3n y causar una denegaci\u00f3n de servicio."
}
],
"id": "CVE-2007-2697",
"lastModified": "2024-11-21T00:31:26.167",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/229"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36072"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34291"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34291"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages."
}
],
"id": "CVE-2005-4759",
"lastModified": "2024-11-21T00:05:06.830",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/149"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/149"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/163 | Exploit, Vendor Advisory | |
| cve@mitre.org | http://securitytracker.com/id?1015528 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/163 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://securitytracker.com/id?1015528 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections."
}
],
"id": "CVE-2006-0419",
"lastModified": "2024-11-21T00:06:25.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/163"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/163"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E758AF8B-B47F-4CE7-B73E-3638180C9D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "651994FC-395B-4268-B976-281B8A34957E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "6AC47FAA-AB16-4728-AE0B-C0C90861D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "E800B227-C828-48CA-B5EF-F315823CD30F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "10E284B8-4EBE-459D-87BA-401BC2AE29C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "56476419-F51B-465C-8BA8-529C59123351",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "5F588A56-E4CB-44A4-A4D3-BFA89D1C6BD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "B23822A2-0B53-4CCC-B62B-8CE48B23F745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "05E4CCAC-8E99-49DE-8E90-18F5C03BBC94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "A19E505D-C095-4266-83C6-414454FB30E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown)."
}
],
"id": "CVE-2006-0430",
"lastModified": "2024-11-21T00:06:26.830",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/174"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/174"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24301"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "2B2BD55C-15DE-4D7B-9B5A-21016B7E2A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:win32:*:*:*:*:*",
"matchCriteriaId": "8932DF57-EE6D-4291-9EA8-F6FC0C991F91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "5AB11D55-95CD-4CB1-B907-CBCFA2A1696A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "41FA5A13-C6AF-463F-B002-376E7C1EF850",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions."
}
],
"id": "CVE-2005-4763",
"lastModified": "2024-11-21T00:05:07.407",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/154"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/154"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges."
}
],
"id": "CVE-2006-0426",
"lastModified": "2024-11-21T00:06:26.263",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/170"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22775"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24290"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22775"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24290"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_express | 9.2 | |
| bea_systems | weblogic_express | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "715D1DD4-A736-4F55-9369-71C232AB14CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_express:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "FF045092-39D3-4598-99DA-D1B35F0DDC3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_express:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61231482-5CC5-4C23-AA48-11E24FB6C94F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en BEA WebLogic Server y Express de 8.1 SP4 a SP6, de 9.2 a MP1 y 10.0 permite a usuarios autentificados remotamente secuestrar sesiones web a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2008-0900",
"lastModified": "2024-11-21T00:43:10.870",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:ga:*:*:*:*:*:*",
"matchCriteriaId": "C49ECE42-9507-4B84-8D78-45B6929CD23C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections."
},
{
"lang": "es",
"value": "BEA WebLogic Server 9.0, 9.1, y 9.2 Gold, cuando se ejecutan en Solaris 9, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (inaccesibilidad del servidor) mediante conexiones socket manipuladas."
}
],
"id": "CVE-2007-0422",
"lastModified": "2024-11-21T00:25:49.563",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/217"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32858"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/217"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| hp | hp-ux | 11.00 | |
| hp | hp-ux | 11.11i | |
| ibm | aix | 4.3.3 | |
| microsoft | windows_2000 | * | |
| microsoft | windows_nt | * | |
| redhat | linux | 6.2 | |
| redhat | linux | 7.1 | |
| sun | solaris | 2.6 | |
| sun | sunos | 5.7 | |
| sun | sunos | 5.8 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| hp | hp-ux | 11.00 | |
| hp | hp-ux | 11.11i | |
| ibm | aix | 4.3.3 | |
| microsoft | windows_2000 | * | |
| microsoft | windows_nt | * | |
| redhat | linux | 6.2 | |
| redhat | linux | 7.1 | |
| sun | solaris | 2.6 | |
| sun | sunos | 5.7 | |
| sun | sunos | 5.8 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| microsoft | windows_2000 | * | |
| microsoft | windows_nt | * | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*",
"matchCriteriaId": "771931F7-9180-4EBD-8627-E1CF17D24647",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:hp:hp-ux:11.11i:v1:*:*:*:*:*:*",
"matchCriteriaId": "8E98B8A6-A071-4BEA-BB39-C64A42816D8A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "465B06C4-136D-4CD8-BA38-B6B50511624C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E545C63-FE9C-4CA1-AF0F-D999D84D2AFD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED27882B-A02A-4D5F-9117-A47976C676E0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:redhat:linux:6.2:*:i386:*:*:*:*:*",
"matchCriteriaId": "B7EC2B95-4715-4EC9-A10A-2542501F8A61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:redhat:linux:7.1:*:i386:*:*:*:*:*",
"matchCriteriaId": "C8783A6D-DFD8-45DD-BF03-570B1B012B44",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34EBF074-78C8-41AF-88F1-DA6726E56F8B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "08003947-A4F1-44AC-84C6-9F8D097EB759",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A2475113-CFE4-41C8-A86F-F2DA6548D224",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*",
"matchCriteriaId": "771931F7-9180-4EBD-8627-E1CF17D24647",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:hp:hp-ux:11.11i:*:*:*:*:*:*:*",
"matchCriteriaId": "C10245E1-C95C-4219-92C9-888E5966ABF7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "465B06C4-136D-4CD8-BA38-B6B50511624C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E545C63-FE9C-4CA1-AF0F-D999D84D2AFD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED27882B-A02A-4D5F-9117-A47976C676E0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:redhat:linux:6.2:*:i386:*:*:*:*:*",
"matchCriteriaId": "B7EC2B95-4715-4EC9-A10A-2542501F8A61",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:redhat:linux:7.1:*:i386:*:*:*:*:*",
"matchCriteriaId": "C8783A6D-DFD8-45DD-BF03-570B1B012B44",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34EBF074-78C8-41AF-88F1-DA6726E56F8B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "08003947-A4F1-44AC-84C6-9F8D097EB759",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A2475113-CFE4-41C8-A86F-F2DA6548D224",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E545C63-FE9C-4CA1-AF0F-D999D84D2AFD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED27882B-A02A-4D5F-9117-A47976C676E0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access."
}
],
"id": "CVE-2003-1437",
"lastModified": "2024-11-20T23:47:08.990",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/6719"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11220"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-25.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/6719"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11220"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/145 | Patch, Vendor Advisory | |
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/150 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/145 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/150 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys."
}
],
"id": "CVE-2005-4755",
"lastModified": "2024-11-21T00:05:06.257",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/145"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/150"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/150"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords."
}
],
"id": "CVE-2003-1226",
"lastModified": "2024-11-20T23:46:39.130",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7587"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7587"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/156 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/156 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection."
}
],
"evaluatorSolution": "Condition: when using the weblogic.Deployer command with the t3 protocol.",
"id": "CVE-2005-4765",
"lastModified": "2024-11-21T00:05:07.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/156"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/156"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/14298 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/14298 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks."
}
],
"id": "CVE-2005-0432",
"lastModified": "2024-11-20T23:55:06.747",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14298"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14298"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-10-20 04:00
Modified
2024-11-20 23:33
Severity ?
Summary
BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://developer.bea.com/alerts/security_000731.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/1525 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://developer.bea.com/alerts/security_000731.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/1525 | Exploit, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 3.1.8 | |
| bea | weblogic_server | 4.0.4 | |
| bea | weblogic_server | 4.5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6E3A5C91-82C4-40B6-B8F2-C083AEF76723",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "76738B84-33DD-450B-90A2-B22B77D52857",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file."
}
],
"id": "CVE-2000-0685",
"lastModified": "2024-11-20T23:33:03.737",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"source": "cve@mitre.org",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-10-20 04:00
Modified
2024-11-20 23:33
Severity ?
Summary
BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://developer.bea.com/alerts/security_000731.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/1525 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://developer.bea.com/alerts/security_000731.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/1525 | Exploit, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 3.1.8 | |
| bea | weblogic_server | 4.0.4 | |
| bea | weblogic_server | 4.5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "742DCC2D-B4AD-4D16-8338-21E258C4FD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6E3A5C91-82C4-40B6-B8F2-C083AEF76723",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "76738B84-33DD-450B-90A2-B22B77D52857",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file."
}
],
"id": "CVE-2000-0684",
"lastModified": "2024-11-20T23:33:03.613",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"source": "cve@mitre.org",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-07/0434.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://developer.bea.com/alerts/security_000731.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1525"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display."
}
],
"id": "CVE-2006-2464",
"lastModified": "2024-11-21T00:11:22.177",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/181"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016094"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26467"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/181"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016094"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26467"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-04-13 04:00
Modified
2024-11-20 23:51
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers."
}
],
"id": "CVE-2004-1756",
"lastModified": "2024-11-20T23:51:40.120",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-04-13T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11358"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1009765"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/566390"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10132"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15862"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1009765"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/566390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10132"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15862"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-01 05:00
Modified
2024-11-20 23:45
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C2EF5B-C454-4BED-81F6-59FCC531D99F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4CB4D0B4-EF75-41BC-BD95-32DAA0BE4415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1719019F-64EB-432D-98DF-839F92C8ED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EC74F617-4CA9-4B0C-87C7-C49A73934CEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "95C77782-600F-4BBB-B71D-C28FDD9AAF60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "30BF1224-40A6-454F-B6CF-3BEEBE3272B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.2:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "87092B8D-8AF5-498C-9187-D64820CF218B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.0.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "D79F6858-4D7F-4EB3-BDB3-957AD6795ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument."
},
{
"lang": "es",
"value": "Vulnerabilidad de scripts en sitios cruzados en la consola de adminstraci\u00f3n de BEA Tuxedo 8.1 y anteriores permite a atacantes remotos inyectar script web arbitrario mediante una argumento INFILE."
}
],
"id": "CVE-2003-0623",
"lastModified": "2024-11-20T23:45:09.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-01T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13561"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13561"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-08-06 04:00
Modified
2024-11-20 23:47
Severity ?
Summary
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| borland_software | j_builder | * | |
| businessobjects | crystal_enterprise | 9 | |
| businessobjects | crystal_enterprise | 10 | |
| businessobjects | crystal_enterprise_java_sdk | 8.5 | |
| businessobjects | crystal_enterprise_ras | 8.5 | |
| businessobjects | crystal_reports | 9 | |
| businessobjects | crystal_reports | 10 | |
| microsoft | business_solutions_crm | 1.2 | |
| microsoft | outlook | 2003 | |
| microsoft | visual_studio_.net | 2003 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:borland_software:j_builder:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A50A593-04D3-4FDA-8015-901750AEE4C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_enterprise:9:*:*:*:*:*:*:*",
"matchCriteriaId": "53235D62-18AA-4482-B9AE-9E1AE87BDB3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_enterprise:10:*:*:*:*:*:*:*",
"matchCriteriaId": "38F02473-3701-413D-B2F2-B400958F22F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_enterprise_java_sdk:8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "3F1A5E6C-F762-4FD1-A105-EFC4E3746B6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_enterprise_ras:8.5:*:unix:*:*:*:*:*",
"matchCriteriaId": "CD34959D-8A0C-48B4-8132-865406EABB4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_reports:9:*:*:*:*:*:*:*",
"matchCriteriaId": "716121F8-EE8D-4A4C-BAB6-943BE3ADDC1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:businessobjects:crystal_reports:10:*:*:*:*:*:*:*",
"matchCriteriaId": "F4D5162B-391B-4B36-A688-8D903218B3B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:business_solutions_crm:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5FFC5454-8557-4886-AEB4-3E04EC6FC477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:outlook:2003:*:business_contact_manager:*:*:*:*:*",
"matchCriteriaId": "F148421C-7BF5-4A58-83DF-4879B27C912A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:*",
"matchCriteriaId": "B9E6C132-4F4B-4FB0-9DDC-DD9750D8552D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via \"..\" sequences in the dynamicimag argument to crystalimagehandler.aspx."
},
{
"lang": "es",
"value": "Vulnerabilidad de atravesamiento de directorios en los visores web de Business Objects Crystal Reports 9 and 10, y Crystal Enterprise 9 o 10, usados en Visual Studio .NET 2003 y Outlook 2003 con Business Contact Manager, Microsoft Business Solutions CRM 1.2, y otros productos, permiten a atacantes remotos leer y borrar ficheros de su elecci\u00f3n mediante secuencias \"..\" en el argumento dynamicimag de crystalimagehandler.aspx."
}
],
"id": "CVE-2004-0204",
"lastModified": "2024-11-20T23:47:59.720",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-08-06T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=108360413811017\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=108671836127360\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11800"
},
{
"source": "cve@mitre.org",
"url": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/6748"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10260"
},
{
"source": "cve@mitre.org",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16044"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=108360413811017\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=108671836127360\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/6748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16044"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-04-13 04:00
Modified
2024-11-20 23:51
Severity ?
Summary
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges."
}
],
"id": "CVE-2004-1758",
"lastModified": "2024-11-20T23:51:40.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-04-13T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11357"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1009764"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/920238"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/5297"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10131"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11357"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1009764"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/920238"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/5297"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15860"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*",
"matchCriteriaId": "98F632B9-0572-4563-BA41-262628A5CB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:ga:express:*:*:*:*:*",
"matchCriteriaId": "D827A0EE-2403-4948-9AFA-9537718BDC5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*",
"matchCriteriaId": "A585B339-442B-4408-9A44-E872FF4406A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:ga:express:*:*:*:*:*",
"matchCriteriaId": "B6C69891-E178-4D9E-898B-68A6A9DB3AEA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0 GA, y 9.1 GA permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2007-2694",
"lastModified": "2024-11-21T00:31:25.710",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/232"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36075"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/232"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36075"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-03-25 05:00
Modified
2024-11-20 23:38
Severity ?
Summary
BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name."
},
{
"lang": "es",
"value": "El Servidor 6.1 Weblogic de BEA Sistemas, permite a atacantes que remotos causar una negaci\u00f3n de servicio v\u00eda una serie de peticiones a archivos .JSP que contengan un nombre de dispositivo de MS-DOS."
}
],
"id": "CVE-2002-0106",
"lastModified": "2024-11-20T23:38:19.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-03-25T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=101050440629269\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/7808.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/3816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=101050440629269\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/7808.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/3816"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files."
},
{
"lang": "es",
"value": "La Consola de Administraci\u00f3n en BEA WebLogic Express y WebLogic Server 9.0 y 9.1 no hace cumplir correctamente ciertas Pol\u00edticas de Seguridad del Dominio, lo cual permite a usuarios administradores remotos en el rol de Desplegador (Deployer) enviar ficheros de su elecci\u00f3n."
}
],
"id": "CVE-2007-2699",
"lastModified": "2024-11-21T00:31:26.470",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/231"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36069"
},
{
"source": "cve@mitre.org",
"url": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34289"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/231"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36069"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34289"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:04
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/140 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.osvdb.org/20094 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/140 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/20094 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges."
}
],
"id": "CVE-2005-4704",
"lastModified": "2024-11-21T00:04:58.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/140"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/20094"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/140"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/20094"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:51
Severity ?
Summary
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges."
}
],
"id": "CVE-2004-1757",
"lastModified": "2024-11-20T23:51:40.280",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/10728"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/350350"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9501"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/10728"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/350350"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14957"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files."
},
{
"lang": "es",
"value": "BEA WebLogic Server 6.1 hasta 6.1 SP7, 7.0 hasta 7.0 SP7, y 8.1 hasta 8.1 SP5 permite a atacantes remotos leer archivos de su elecci\u00f3n dentro de la propiedad class-path a trav\u00e9s de .ear o explotar los archivos .ear que utiliza el manifiesto class-path adecuadamente para idnicar el uso de achivos .jar"
}
],
"id": "CVE-2007-0412",
"lastModified": "2024-11-21T00:25:47.987",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/206"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38505"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/206"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers."
},
{
"lang": "es",
"value": "Vulnerabilidad sin especificar en el BEA WebLogic Server 6.1 Gold hata el SP7 y el 7.0 Gold hasta el SP7, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (agotamiento de disco) a trav\u00e9s de ciertas cabeceras HTTP malformadas."
}
],
"id": "CVE-2007-4618",
"lastModified": "2024-11-21T00:36:01.920",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/247"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38517"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36321"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/247"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38517"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36321"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la Administration Console de BEA WebLogic Server y Express de 9.0 a 10.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de URLs modificados que no se manipulan correctamente por Unexpected Exception Page (Excepci\u00f3n de P\u00e1gina no Esperada)."
}
],
"id": "CVE-2008-0899",
"lastModified": "2024-11-21T00:43:10.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/269"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019448"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword."
}
],
"id": "CVE-2004-2321",
"lastModified": "2024-11-20T23:53:03.370",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9505"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008867.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14962"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9505"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008867.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14962"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information."
}
],
"id": "CVE-2006-0424",
"lastModified": "2024-11-21T00:06:25.973",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/168"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/22776"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24295"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/22776"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24295"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-03-22 01:02
Modified
2024-11-21 00:08
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents."
}
],
"id": "CVE-2006-1352",
"lastModified": "2024-11-21T00:08:39.050",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-03-22T01:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/183"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19310"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1015790"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/17167"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25348"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/183"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015790"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/17167"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25348"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys."
}
],
"evaluatorSolution": "Hyperlink #907650 has patches for the following products:\r\nWebLogic Server 9.1\r\nWebLogic Server 9.0\r\nThis vulnerability is addressed in the following product releases:\r\nBEA Systems, Weblogic Server, 8.1 SP 6\r\nBEA Systems, Weblogic Express, 8.1 SP 6\r\nBEA Systems, Weblogic Server, 7.0 SP 7\r\nBEA Systems, Weblogic Express, 7.0 SP 7\r\nBEA Systems, Weblogic Server, 6.1 SP 8\r\nBEA Systems, Weblogic Express, 6.1 SP 8",
"id": "CVE-2006-2472",
"lastModified": "2024-11-21T00:11:23.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/186"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016095"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26466"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016095"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26466"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/161 | Patch, Vendor Advisory | |
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/178 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| cve@mitre.org | http://www.securityfocus.com/bid/17168 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/161 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/178 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/17168 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "41FA5A13-C6AF-463F-B002-376E7C1EF850",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password."
}
],
"id": "CVE-2005-4767",
"lastModified": "2024-11-21T00:05:08.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/161"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/178"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/161"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/178"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17168"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications."
},
{
"lang": "es",
"value": "La implementaci\u00f3n del cliente SSL en el BEA WebLogic Server 7.0 Gold hasta el SP7, el 8.1 Gold hasta el SP6, el 9.0, el 9.1, el 9.2 Gold hasta el MP1 y el 10.0, selecciona algunas veces una clave nula cuando no son compatibles otras claves entre el servidor y el cliente, lo que puede permitir a atacantes remotos interceptar las comunicaciones."
}
],
"id": "CVE-2007-4616",
"lastModified": "2024-11-21T00:36:01.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/245"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1018620"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1018620"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/25472"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36320"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-07 04:00
Modified
2024-11-20 23:48
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown)."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2 no hace cumplir las restricciones de sitio para iniciar y parar servidores a usuarios en los papeles de seguridad Admin y Operator, lo que permite a usuarios no autorizados causar una denegaci\u00f3n de servicio (parada del servicio)"
}
],
"id": "CVE-2004-0471",
"lastModified": "2024-11-20T23:48:39.423",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-07-07T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11594"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1010129"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/6077"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/10327"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16121"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11594"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1010129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/6077"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/10327"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16121"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-27 04:00
Modified
2024-11-20 23:49
Severity ?
Summary
The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp | ||
| cve@mitre.org | http://www.kb.cert.org/vuls/id/574222 | Patch, Third Party Advisory, US Government Resource | |
| cve@mitre.org | http://www.securityfocus.com/bid/10188 | Patch, Vendor Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/15926 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/574222 | Patch, Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/10188 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/15926 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges."
},
{
"lang": "es",
"value": "Las herramientes de configuracion (1) config.sh en Unix o (2) config.cmd en Windows de BEA WebLogic Server 8.1 a SP2 crean un fichero de registro que contiene el nombre y la contrase\u00f1a del administrador en texto claro, lo que podr\u00eda permitir a usuarios locales ganar privilegios."
}
],
"id": "CVE-2004-0712",
"lastModified": "2024-11-20T23:49:13.797",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-07-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/574222"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10188"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15926"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_58.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/574222"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10188"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15926"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "F119CDFF-214B-42E3-AF10-D8172D4A18E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "56955D93-989A-4746-A3FC-1C99A749FAAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*",
"matchCriteriaId": "B2B4C4E8-2862-457F-BDCC-3F54B8F7AADE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:express:*:*:*:*:*",
"matchCriteriaId": "16324B74-4143-473D-858F-B5B1899822B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:win32:*:*:*:*:*",
"matchCriteriaId": "6ABD1B84-730D-479B-BB39-98C7D5C2373D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*",
"matchCriteriaId": "47974FFB-1B28-492B-9A83-78AF16CF62CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:express:*:*:*:*:*",
"matchCriteriaId": "DFA4200B-3877-4FC9-B2AB-E51675CAD71F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:win32:*:*:*:*:*",
"matchCriteriaId": "9787A30B-B85C-4434-AE28-03F5B5C8DEBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*",
"matchCriteriaId": "6F27425D-1754-44AE-A4B5-F27D5FA6A052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:express:*:*:*:*:*",
"matchCriteriaId": "B1C2B98A-EF68-4569-B50C-8F21D2298435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:win32:*:*:*:*:*",
"matchCriteriaId": "F80AE1DC-B4B6-4E8C-A199-BFF64B0563F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*",
"matchCriteriaId": "034C62E6-3598-4D66-A0BD-8BD2E67048C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp13:express:*:*:*:*:*",
"matchCriteriaId": "7D5A058C-D9DD-4B78-815E-40E27EC1C6BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp13:win32:*:*:*:*:*",
"matchCriteriaId": "73589C92-14F1-494E-B264-A632A03DFCCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "FD3C09F5-6E4A-43C4-8AEB-7DBBDE9DCC33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "8ACD6465-6904-4F6B-92F0-02078D0B41BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "BDF43AB2-1778-4B6D-B766-FF71DBE3C0A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "13C06026-2AC9-4419-A7B8-9F0ECDD8DBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "883ABAC3-3D2D-4D1A-8125-96A7CC0CE93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "EF96A26E-7284-43A0-BD6A-907E1029197D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "9B6656CF-65ED-4F8E-B9F2-75A9DC1571D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "0DDF3D79-F7B0-4FB2-B22C-B432BDC24B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "C8479B6C-464F-41BC-BF81-31EA74CEF4D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "7C013AE2-4B06-437A-815F-FAADD28CFA85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:win32:*:*:*:*:*",
"matchCriteriaId": "F13D9A20-173F-46AB-8473-E69F6D617112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*",
"matchCriteriaId": "B08241CF-0F3D-44E2-8D72-4F98413933EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:express:*:*:*:*:*",
"matchCriteriaId": "D7306C09-BFBA-4DC0-8EA1-E5A5C0BC080F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:win32:*:*:*:*:*",
"matchCriteriaId": "BC28783D-34C6-49B7-A02F-059DED18E71D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting."
}
],
"id": "CVE-2004-2320",
"lastModified": "2024-11-20T23:53:03.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/68"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/10726"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/867593"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3726"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9506"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008866.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14959"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/68"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/10726"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/867593"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3726"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securitytracker.com/alerts/2004/Jan/1008866.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14959"
}
],
"sourceIdentifier": "cve@mitre.org",
"vendorComments": [
{
"comment": "The Apache Software Foundation do not treat this as a security issue. A configuration change can be made to disable the ability to respond to HTTP TRACE requests if required.\n\nFor more information please see:\nhttp://www.apacheweek.com/issues/03-01-24#news",
"lastModified": "2008-03-05T00:00:00",
"organization": "Red Hat"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-07-05 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a \"Transfer-Encoding: chunked\" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka \"HTTP Request Smuggling.\""
}
],
"id": "CVE-2005-2092",
"lastModified": "2024-11-20T23:58:47.030",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-07-05T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://seclists.org/lists/bugtraq/2005/Jun/0025.html"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014366"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securiteam.com/securityreviews/5GP0220G0U.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42901"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/lists/bugtraq/2005/Jun/0025.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014366"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securiteam.com/securityreviews/5GP0220G0U.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42901"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server\u0027s SSL identity via unknown attack vectors."
}
],
"id": "CVE-2006-0431",
"lastModified": "2024-11-21T00:06:26.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/175"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24302"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/175"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24302"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "868143C0-88F3-47FB-8590-C0B60BE7970D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage)."
},
{
"lang": "es",
"value": "El plug-in de proxy de BEA WebLogic Server anterior a Junio de 2006 para el Apache HTTP Server no maneja adecuadamente errores de protocolo, lo cual permite a atacantes remotos provocar una denegaci\u00f3n de servicio (apag\u00f3n del servidor)."
}
],
"id": "CVE-2007-0419",
"lastModified": "2024-11-21T00:25:49.093",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/213"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38513"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-16 01:19
Modified
2024-11-21 00:31
Severity ?
Summary
BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket."
},
{
"lang": "es",
"value": "BEA WebLogic Server 9.0 hasta 9.2 permite a atacantes remotos causar una denegaci\u00f3n de servicio (indisponibilidad de puerto SSL) teniendo acceso a un socket SSL a medio cerrar."
}
],
"id": "CVE-2007-2704",
"lastModified": "2024-11-21T00:31:27.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 5.4,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-16T01:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/237"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36064"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34278"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/237"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36064"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25284"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1018057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34278"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without \"receive\" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en BEA WebLogic Server de 9.0 a 10.0 permite a usuarios autentificados remotamente sin los permisos \"receive (recibir)\" evitar las restricciones de acceso previstas y recibir mensajes de un JMS Topic independiente o un destino de miembro Distributed Topic seguro, relacionados a subscripciones duraderas."
}
],
"id": "CVE-2008-0897",
"lastModified": "2024-11-21T00:43:10.450",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/267"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified \"sequences of events.\""
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en la administraci\u00f3n de hilos en BEA WebLogic 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP5, 9.0, y 9.1, cuando se usa la autenticaci\u00f3n T3, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (cuelgue de hilo y de sistema) mediante \"secuencias de eventos\" no especificadas."
}
],
"id": "CVE-2007-0410",
"lastModified": "2024-11-21T00:25:47.673",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/204"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38502"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/204"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-27 04:00
Modified
2024-11-20 23:49
Severity ?
Summary
The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges."
},
{
"lang": "es",
"value": "El proveedor de Autenticaci\u00f3n WebLogic en BEA WebLogic Server y WebLogic Express 8.1 hasta SP2 y 7.0 hasta SP4 no elimina relaciones entre miembros cuando se borra un grupo, lo que puede causar que un nuevo grupo con el mismo nombre tenga miembros del grupo antiguo, lo que permite a miembros del grupo ganar privilegios."
}
],
"id": "CVE-2004-0715",
"lastModified": "2024-11-20T23:49:14.230",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2004-07-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/11356"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1009763"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/470470"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/5299"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10130"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/11356"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1009763"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/470470"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/5299"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15861"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/144 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/144 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving \"network address translation.\""
}
],
"id": "CVE-2005-4754",
"lastModified": "2024-11-21T00:05:06.120",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/144"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/144"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "2B2BD55C-15DE-4D7B-9B5A-21016B7E2A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "C54D9244-D6EA-4AA6-94B4-15D232F1D6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp8:win32:*:*:*:*:*",
"matchCriteriaId": "8932DF57-EE6D-4291-9EA8-F6FC0C991F91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*",
"matchCriteriaId": "596178D8-B7BB-4793-81C1-119ED353CF2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "5AB11D55-95CD-4CB1-B907-CBCFA2A1696A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "24E0BA12-971C-4DC4-8ED2-9B7DCD6390E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "41FA5A13-C6AF-463F-B002-376E7C1EF850",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors."
}
],
"evaluatorSolution": "The vendor has released multiple advisories, as well as fixes to address these issues.",
"id": "CVE-2005-4750",
"lastModified": "2024-11-21T00:05:05.483",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/138"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password."
}
],
"id": "CVE-2003-1222",
"lastModified": "2024-11-20T23:46:38.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/63"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-22 21:44
Modified
2024-11-21 00:43
Severity ?
Summary
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_server | 10.0 | |
| bea_systems | weblogic_server | 10.0_mp1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*",
"matchCriteriaId": "321BC193-5FBF-4F25-996D-1FE74779F34D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*",
"matchCriteriaId": "E23EB6FE-EA07-426F-9781-87630BC76FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4B4A86-A381-4DB1-AA9D-57DBEC2466CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not."
},
{
"lang": "es",
"value": "BEA WebLogic Server y Express de 7.0 a 10.0 permite a atacantes remotos llevar a cabo ataques para adivinar contrase\u00f1as mediante fuerza bruta, incluso cuando se ha activado el cierre de cuenta, a trav\u00e9s de URLs manipulados que indican si la contrase\u00f1a supuesta es buena o no."
}
],
"id": "CVE-2008-0901",
"lastModified": "2024-11-21T00:43:11.013",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-22T21:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.s21sec.com/avisos/s21sec-040-en.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/488686/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges."
}
],
"id": "CVE-2003-1094",
"lastModified": "2024-11-20T23:46:20.300",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/999788"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/8320"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12799"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/999788"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/8320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12799"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages."
}
],
"evaluatorSolution": "This vulnerability is addressed in the following product releases:\r\nBEA Systems Weblogic Server 5.1 SP 7\r\nBEA Systems WebLogic Express 5.1 SP 7",
"id": "CVE-2000-1238",
"lastModified": "2024-11-20T23:34:20.147",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/5089"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/5089"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5588"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/142 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/142 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role."
}
],
"id": "CVE-2005-4752",
"lastModified": "2024-11-21T00:05:05.807",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/142"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/142"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/157 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/157 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic."
}
],
"id": "CVE-2005-4766",
"lastModified": "2024-11-21T00:05:07.853",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/157"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-10-04 04:00
Modified
2024-11-20 23:40
Severity ?
Summary
Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 5.1 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCD5D4AD-0BA3-42F7-852F-524488D74A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:express:*:*:*:*:*",
"matchCriteriaId": "A8F69E7A-8BBB-4D20-AEE9-F37155AD5C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2B393A66-08A6-4EBA-B01E-BB6418423F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "0FAB4F19-EFE0-4860-B9E9-E3938A36AE17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*",
"matchCriteriaId": "B2B4C4E8-2862-457F-BDCC-3F54B8F7AADE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp10:express:*:*:*:*:*",
"matchCriteriaId": "16324B74-4143-473D-858F-B5B1899822B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp11:express:*:*:*:*:*",
"matchCriteriaId": "DFA4200B-3877-4FC9-B2AB-E51675CAD71F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*",
"matchCriteriaId": "6F27425D-1754-44AE-A4B5-F27D5FA6A052",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp12:express:*:*:*:*:*",
"matchCriteriaId": "B1C2B98A-EF68-4569-B50C-8F21D2298435",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "99D0A3A8-1444-4DA4-AEF3-08578482574C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8B0B183B-95A3-463D-B76B-50640F554013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "523836A4-0110-4CD3-A81E-988A02AEA68C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "36A0EFDA-409E-44F0-9F8B-167A72D2361B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "A705EB67-3961-445F-8023-F82C7618BE2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "51A8AB95-FB23-4A7A-A6F5-EF442EAABD26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "BD698DD8-5491-4A73-A527-8C9228992A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "5F00947F-1804-41D5-8F2B-7E48C77B1306",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "86C4679F-F13F-4A97-AE42-BC54BD0F149C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "114E5E3E-84B2-4DD3-98FC-2ABFFA41BAD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "EF96A26E-7284-43A0-BD6A-907E1029197D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "9B6656CF-65ED-4F8E-B9F2-75A9DC1571D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*",
"matchCriteriaId": "C8479B6C-464F-41BC-BF81-31EA74CEF4D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp8:express:*:*:*:*:*",
"matchCriteriaId": "7C013AE2-4B06-437A-815F-FAADD28CFA85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*",
"matchCriteriaId": "B08241CF-0F3D-44E2-8D72-4F98413933EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:sp9:express:*:*:*:*:*",
"matchCriteriaId": "D7306C09-BFBA-4DC0-8EA1-E5A5C0BC080F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections."
}
],
"id": "CVE-2002-1030",
"lastModified": "2024-11-20T23:40:25.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-10-04T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html"
},
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm"
},
{
"source": "cve@mitre.org",
"url": "http://online.securityfocus.com/archive/1/281046"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9486.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5159"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications\u0026path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://online.securityfocus.com/archive/1/281046"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9486.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5159"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | jrockit | * | |
| bea | weblogic_server | * | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:jrockit:*:r24.5:*:*:*:*:*:*",
"matchCriteriaId": "9979205D-FC70-4FD8-B69F-AFFA4E8E3979",
"versionEndIncluding": "1.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an \"overflow condition,\" probably a buffer overflow."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en BEA WebLogic Platform and Server 8.1 hasta 8.1 SP5, y JRockit 1.4.2 R4.5 y anteriores, permite a los atacantes obtener privilegios a trav\u00e9s de vectores no especificados, relacionados con una \"condici\u00f3n de desbordamiento\", probablemente un desbordamiento de b\u00fafer."
}
],
"id": "CVE-2007-0425",
"lastModified": "2024-11-21T00:25:50.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/222"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38515"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/222"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:mp2:*:*:*:*:*:*",
"matchCriteriaId": "C2A3768A-527C-4CDA-A544-E34AD84D8B8A",
"versionEndIncluding": "9.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "7A75A7F9-A99A-4C8E-9867-71FA8A55DD70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F9ABCC-5217-4650-8C71-F8B0EB86789F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications."
},
{
"lang": "es",
"value": "La implementaci\u00f3n del cliente SSL en el BEA WebLogic Server 7.0 SP7, el 8.1 SP2 hasta el SP6, el 9.0, el 9.1, el 9.2 Gold hasta el MP2 y el 10.0, selecciona algunas veces una clave nula cuando otras est\u00e1n habilitadas, lo que puede permitir a atacantes remotos interceptar las comunicaciones."
}
],
"id": "CVE-2007-4615",
"lastModified": "2024-11-21T00:36:01.450",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/244"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1018619"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/25472"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36322"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/244"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1018619"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/25472"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36322"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-03-22 01:02
Modified
2024-11-21 00:08
Severity ?
Summary
BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a \"default internal servlet\" accessed through HTTP."
}
],
"id": "CVE-2006-1351",
"lastModified": "2024-11-21T00:08:38.907",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-03-22T01:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/180"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19310"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1015792"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17166"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25347"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/180"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015792"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1021"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25347"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-07-27 04:00
Modified
2024-11-20 23:49
Severity ?
Summary
The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown."
},
{
"lang": "es",
"value": "El m\u00e9todo remove en una Enterprise JavaBean (EJB) con estado en BEA WebLogic Server y WebLogic Express version 8.1 hasta SP2, 7.0 hasta SP4, y 6.1 a SP6, no comprueba adecuadamente permisos EJB antes de dejar de exportar una habichuela (bean), lo que permite a usuarios remotos autenticados eliminar objetos EJB de vistas remotas antes de que se lance la excepci\u00f3n de seguridad."
}
],
"id": "CVE-2004-0713",
"lastModified": "2024-11-20T23:49:13.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-07-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/658878"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10185"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15928"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/658878"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15928"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/201 | Patch, Vendor Advisory | |
| cve@mitre.org | http://osvdb.org/45838 | Broken Link | |
| cve@mitre.org | http://www.securityfocus.com/bid/22082 | Patch, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/201 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/45838 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/22082 | Patch, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461."
},
{
"lang": "es",
"value": "Librer\u00eda SSL en el BEA WebLogic Server 6.1 Gold hasta el SP7, 7.0 Gold hasta el SP7 y el 8.1 Gold hasta el SP5, pueden permitir a atacantes remotos la obtenci\u00f3n de texto plano de un chorro SSL a trav\u00e9s de un ataque de \"hombre en el medio\" (man-in-the-middle) que inyecta datos modificados y medidas transcurriendo tiempo hasta que un error responda. Vulnerabilidad diferente a la CVE-2006-2461."
}
],
"id": "CVE-2007-4613",
"lastModified": "2024-11-21T00:36:01.157",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/201"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/45838"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/201"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/45838"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/22082"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "868143C0-88F3-47FB-8590-C0B60BE7970D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en la extensi\u00f3n de proxy de BEA WebLogic Server anterior a Septiembre de 2006 para Netscape Enterprise Server permite a atacantes remotos provocar una denegaci\u00f3n de servicio mediante determinadas peticiones que disparan errores que llevan al servidor a ser marcado como no disponible, a un fallo de servidor de alojamiento web, o al agotamiento de CPU."
}
],
"id": "CVE-2007-0424",
"lastModified": "2024-11-21T00:25:49.890",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/219"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32856"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/219"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/143 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/143 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain \"heavy usage\" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection."
}
],
"id": "CVE-2005-4753",
"lastModified": "2024-11-21T00:05:05.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/143"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/143"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-31 00:17
Modified
2024-11-21 00:36
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/246 | Vendor Advisory | |
| cve@mitre.org | http://osvdb.org/38518 | Broken Link | |
| cve@mitre.org | http://secunia.com/advisories/26539 | Third Party Advisory | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2007/3008 | Third Party Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/36319 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/246 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://osvdb.org/38518 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/26539 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2007/3008 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/36319 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*",
"matchCriteriaId": "F5D61A68-E83A-4374-832A-C9A2FEA0AD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad sin especificar en el BEA WebLogic Server 6.1 Gold hasta el SP7, el 7.0 Gold hasta el SP7 y el 8.1 Gold hasta el SP4 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (cuelgue del hilo del servidor) a trav\u00e9s de vectores sin especificar."
}
],
"id": "CVE-2007-4617",
"lastModified": "2024-11-21T00:36:01.767",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-31T00:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/246"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38518"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36319"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/246"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/38518"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/26539"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2007/3008"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36319"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
},
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-01 05:00
Modified
2024-11-20 23:45
Severity ?
Summary
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1C2EF5B-C454-4BED-81F6-59FCC531D99F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4CB4D0B4-EF75-41BC-BD95-32DAA0BE4415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1719019F-64EB-432D-98DF-839F92C8ED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EC74F617-4CA9-4B0C-87C7-C49A73934CEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "95C77782-600F-4BBB-B71D-C28FDD9AAF60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:tuxedo:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "30BF1224-40A6-454F-B6CF-3BEEBE3272B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:4.2:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "87092B8D-8AF5-498C-9187-D64820CF218B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.0.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "D79F6858-4D7F-4EB3-BDB3-957AD6795ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:5.1:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "AC966FC9-3ED4-4CCD-B1E6-74E8CC7CEBCD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX."
},
{
"lang": "es",
"value": "La consola de adminstraci\u00f3n de BEA Tuxedo 8.1 y anteriores permite a atacantes remotos causar una denegaci\u00f3n de servicio (cuelgue) mediante argumentos de nombre de ruta que contienen nombres de dispositivos de MS-DOS como CON o AUX."
}
],
"id": "CVE-2003-0622",
"lastModified": "2024-11-20T23:45:09.793",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-01T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13560"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=106762000607681\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/8931"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13560"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-03 04:00
Modified
2024-11-20 23:57
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action."
}
],
"id": "CVE-2005-1380",
"lastModified": "2024-11-20T23:57:12.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-03T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111472745503010\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15128"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://securitytracker.com/alerts/2005/Apr/1013817.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/15895"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/13400"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20276"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111472745503010\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15128"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://securitytracker.com/alerts/2005/Apr/1013817.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/15895"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.red-database-security.com/advisory/bea_css_in_admin_console.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/13400"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20276"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources."
}
],
"id": "CVE-2006-0432",
"lastModified": "2024-11-21T00:06:27.123",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/176"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24299"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/176"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24299"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/153 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/153 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "3BA3BF4B-7616-49BA-916B-17068B6C85E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges."
}
],
"id": "CVE-2005-4762",
"lastModified": "2024-11-21T00:05:07.263",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/153"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/153"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:54
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an \"unexpected user identity\" to be used in an RMI call."
}
],
"id": "CVE-2004-2696",
"lastModified": "2024-11-20T23:54:00.243",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/59"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11865"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1010493"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/7081"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/10545"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16421"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/59"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11865"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1010493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/7081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/10545"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16421"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/127 | Product | |
| cve@mitre.org | http://secunia.com/advisories/15486 | Broken Link, Vendor Advisory | |
| cve@mitre.org | http://securitytracker.com/id?1014049 | Broken Link, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.securityfocus.com/bid/13717 | Broken Link, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.vupen.com/english/advisories/2005/0604 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/127 | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/15486 | Broken Link, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://securitytracker.com/id?1014049 | Broken Link, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/13717 | Broken Link, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.vupen.com/english/advisories/2005/0604 | Broken Link |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "767A0007-20E7-4E77-ACA9-2A812433B509",
"versionEndIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings."
}
],
"id": "CVE-2005-1744",
"lastModified": "2024-11-20T23:58:02.007",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.vupen.com/english/advisories/2005/0604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://dev2dev.bea.com/pub/advisory/127"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.vupen.com/english/advisories/2005/0604"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-459"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:43
Severity ?
Summary
BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/38 | ||
| cve@mitre.org | http://www.iss.net/security_center/static/10221.php | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/5819 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/38 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.iss.net/security_center/static/10221.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/5819 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users."
}
],
"id": "CVE-2002-2177",
"lastModified": "2024-11-20T23:43:03.570",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2002-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/38"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/10221.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5819"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/38"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/10221.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5819"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-10-20 04:00
Modified
2024-11-20 23:33
Severity ?
Summary
Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/1570 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/1570 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E27911BD-A0AE-46F4-BF7D-842E466715FB",
"versionEndIncluding": "4.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension."
}
],
"id": "CVE-2000-0681",
"lastModified": "2024-11-20T23:33:03.240",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-10-20T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1570"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2000-08/0186.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/1570"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:42
Severity ?
Summary
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions."
}
],
"id": "CVE-2002-2141",
"lastModified": "2024-11-20T23:42:58.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/39"
},
{
"source": "cve@mitre.org",
"url": "http://www.iss.net/security_center/static/10291.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/5846"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/39"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.iss.net/security_center/static/10291.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/5846"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/152 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/152 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Patch |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:express:*:*:*:*:*",
"matchCriteriaId": "FED6AE20-974B-44A7-98C4-F69E6E33D9DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:win32:*:*:*:*:*",
"matchCriteriaId": "38DB9544-534D-4B95-B81A-7F80B6E6F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used."
}
],
"evaluatorSolution": "An attacker must have read access to the server log to see the sensitive values.",
"id": "CVE-2005-4761",
"lastModified": "2024-11-21T00:05:07.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 1.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/152"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service."
}
],
"id": "CVE-2005-1748",
"lastModified": "2024-11-20T23:58:02.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/131"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0608"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0608"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/147 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/147 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly \"constrain\" a \"/\" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections."
}
],
"id": "CVE-2005-4757",
"lastModified": "2024-11-21T00:05:06.547",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/147"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/147"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic."
}
],
"id": "CVE-2006-2461",
"lastModified": "2024-11-21T00:11:21.780",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/194"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016102"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26459"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/194"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016102"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26459"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords."
}
],
"id": "CVE-2003-1225",
"lastModified": "2024-11-20T23:46:39.000",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7563"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp7:*:*:*:*:*:*",
"matchCriteriaId": "69F01ECA-151B-4C6E-A202-6EE6DF9B609B",
"versionEndIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "2A489A8E-D3AE-42DF-8DCF-5A9EF10778FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity."
},
{
"lang": "es",
"value": "BEA WebLogic Server 7.0 hasta 7.0 SP7, 8.1 hasta 8.1 SP5, 9.0, y 9.1, cuando se usa el dominio de compatibilidad con WebLogic Server 6.1, permite a los atacantes ejecutar determinadas operaciones de persistencia de contenedores EJB con una identidad administrativa."
}
],
"id": "CVE-2007-0417",
"lastModified": "2024-11-21T00:25:48.780",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/211"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38511"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/164 | Patch, Vendor Advisory | |
| cve@mitre.org | http://securitytracker.com/id?1015528 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/164 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://securitytracker.com/id?1015528 | Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause \"looping stack overflow errors.\""
}
],
"id": "CVE-2006-0420",
"lastModified": "2024-11-21T00:06:25.400",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/164"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/164"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | * | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp6:*:*:*:*:*:*",
"matchCriteriaId": "614F8329-684E-4B39-A318-33A8E21270FA",
"versionEndIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp4:*:*:*:*:*:*",
"matchCriteriaId": "694AF942-2D1E-4CB6-B9BE-AC1C2ACD7381",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password."
},
{
"lang": "es",
"value": "BEA WebLogic 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP4, y 9.0 lanzamiento inicial no encripta las contrase\u00f1as almacenadas en JDBCDataSourceFactory MBean Properties, lo cual permite a usuarios administrativos locales leer las contrase\u00f1as en texto plano."
}
],
"id": "CVE-2007-0409",
"lastModified": "2024-11-21T00:25:47.507",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 1.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 2.7,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/203"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38501"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/203"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-24 04:00
Modified
2024-11-20 23:58
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2D9AB3C0-8783-4160-AE2D-D1E5AAAA0A78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:express:*:*:*:*:*",
"matchCriteriaId": "80D90123-74BA-4A70-9A10-6980BAD270B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "565CBD39-28D6-4A03-BECE-287083CE9FA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "BDE9282D-C32F-4D2F-81BE-75E447925A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "14A085BB-27C9-488F-91F8-19625BF23B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "D1A33785-23D9-4428-B746-71FD404C09E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "3E6644EF-C875-4005-A628-0AED7B7BB94F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "8556E775-D130-4658-AFE2-28188224ED54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "1B92BC8B-15AB-4E9A-AC2F-DD6A2F443B36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "AC5439C1-D06F-44C6-94F5-2BD8598A506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "E40C38EC-ECA4-4F0C-8468-16191CDB9997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "C4FD8871-680E-40F9-85AB-417B5195D4BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "2B4BC3F5-BFE8-4834-B427-B6260D5B7A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "D2FE768F-363B-49BC-8410-739B164FB32E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "D3DA28D0-18CC-4F99-AABB-EC7863CBD455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:win32:*:*:*:*:*",
"matchCriteriaId": "CE1D6EE4-8545-4D0A-A50B-C8009F054DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:win32:*:*:*:*:*",
"matchCriteriaId": "6C444DA3-69E3-4465-9173-85966B1162A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "5485722F-5DE4-4CD4-865F-32585537F523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "BCB01060-2C29-4F75-8D0A-74F62E9F0A17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "3CCEDE54-97F3-457A-9886-5BD91C9AED2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "2269D44C-65EA-4ED0-9F03-A32AC5D44EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "A3DFE048-905E-4890-809D-F6BCEF7F83C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "349036A0-B5E2-4656-8D2D-26BEE9EF9DFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "D00633D1-4B38-48D9-B5CD-E8D66EA90599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "1A1A59C0-31BB-4EE9-90C1-3289C94F690E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "209CDA09-CAB2-481D-8DA0-161B670335E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:weblogic_portal:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A220FA9-69A3-4857-A73D-287FDF0E68A1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password."
}
],
"id": "CVE-2005-1747",
"lastModified": "2024-11-20T23:58:02.457",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-24T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/130"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111695844803328\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111695921212456\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111722298705561\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111722380313416\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "cve@mitre.org",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111695844803328\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111695921212456\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111722298705561\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111722380313416\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/15486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1014049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-1-PUB.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.acrossecurity.com/aspr/ASPR-2005-05-24-2-PUB.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.appsecinc.com/resources/alerts/general/BEA-002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/13717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0607"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-21 01:44
Modified
2024-11-21 00:43
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.2 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea | weblogic_workshop | 8.1 | |
| bea_systems | weblogic | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7BA8C449-ECD0-46E5-A7D6-740DE8DEE0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "AD6F9694-259F-4631-BC93-B1136F08E77E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "77624161-7740-4162-9C83-C0DFEA2BBCCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "E785D039-3426-4C1F-BBA8-7C6D32FB141E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "D4B2A474-B6C4-47B6-8B20-8722A8C25238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_workshop:8.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "2FDBD7AF-51AC-48B9-A465-0C13B9230EE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea_systems:weblogic:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "66DD06E2-B659-4927-9DEA-8B88CA56D75D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a \"framework defined request parameter\" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Workshop de 8.1 a SP6 y Workshop para WebLogic de 9.0 a 10.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un \"par\u00e1metro de petici\u00f3n de marco de trabajo definido\" cuando se utiliza WebLogic Workshop o el marco de trabajo Apache Beehive NetUI con flujos de p\u00e1gina."
}
],
"id": "CVE-2008-0869",
"lastModified": "2024-11-21T00:43:06.810",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-02-21T01:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019438"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0611"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019438"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:46
Severity ?
Summary
BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 7.0.0.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:win32:*:*:*:*:*",
"matchCriteriaId": "8DEDDAF2-555D-4425-B4B6-65B1E9C21FF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "9CD2BB36-AC0B-48E9-91E1-A4465896E87A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "A5C59B80-279B-45B3-9CC1-5A263681025B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:win32:*:*:*:*:*",
"matchCriteriaId": "D2D05BAB-AB3B-466E-8301-01A41644DE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:win32:*:*:*:*:*",
"matchCriteriaId": "935F28E3-9799-4EF6-AB83-62E9C214DD0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74AE35FF-AC1C-435B-8CE9-F40AFFFA3A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:express:*:*:*:*:*",
"matchCriteriaId": "25C711BB-E7E0-41D8-985E-5DD386C54637",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:win32:*:*:*:*:*",
"matchCriteriaId": "38EFE72C-10E5-4EED-B016-D914FA52DE6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "32E8797D-1B62-4480-A79D-0345E65699E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "071FAD20-D502-4634-852A-4CD06FE8E114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:win32:*:*:*:*:*",
"matchCriteriaId": "97E6F518-D320-4655-B698-2D1A82CA3EDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "2FC1486C-6AC4-44F7-9015-40FD4A341C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "AB5909DB-B2E2-4358-9D45-C225C6B02360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:win32:*:*:*:*:*",
"matchCriteriaId": "04C3F96B-A1FF-4E3E-B059-366E176E5E19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions."
}
],
"id": "CVE-2003-1221",
"lastModified": "2024-11-20T23:46:38.460",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev2dev.bea.com/pub/advisory/32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev2dev.bea.com/pub/advisory/32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/9034"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-23 00:28
Modified
2024-11-21 00:25
Severity ?
Summary
BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | * | |
| bea | weblogic_server | * | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp6:*:*:*:*:*:*",
"matchCriteriaId": "614F8329-684E-4B39-A318-33A8E21270FA",
"versionEndIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:*:sp5:*:*:*:*:*:*",
"matchCriteriaId": "22897797-8E89-4B31-99B8-B22D6F6056A3",
"versionEndIncluding": "8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods."
},
{
"lang": "es",
"value": "BEA WebLogic Server 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP5, 9.0, y 9.1 no hace cmplir las pol\u00edticas de seguridad que declara los permisos para los m\u00e9todos EJB que tienen par\u00e1metros array, lo cual permite a atacantes remotos obtener acceso no autorizado a estos m\u00e9todos."
}
],
"id": "CVE-2007-0418",
"lastModified": "2024-11-21T00:25:48.940",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-23T00:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/212"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/38512"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/212"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/38512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0213"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/148 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/148 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an \"internal servlet\" accessed through HTTP."
}
],
"id": "CVE-2005-4758",
"lastModified": "2024-11-21T00:05:06.697",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/148"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/148"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:express:*:*:*:*:*",
"matchCriteriaId": "05AFBE78-C611-4EA2-8B00-5F8B61696CBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended."
}
],
"id": "CVE-2006-0421",
"lastModified": "2024-11-21T00:06:25.537",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/165"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18581"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/165"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18581"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24286"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.0 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "703482E8-35A9-4A9F-A9FD-B0F8CEA4A404",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1FDCF6AE-43DC-4AE5-9260-CA657F40BE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges."
}
],
"id": "CVE-2006-2469",
"lastModified": "2024-11-21T00:11:22.857",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/189"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1016098"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26463"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/189"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1016098"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26463"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-01-25 23:07
Modified
2024-11-21 00:06
Severity ?
Summary
Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 6.1 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "5DFE26B3-31F2-4FC0-854D-56EA4D08C28A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "C3B7752C-B297-480A-B3FC-948EA081670C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "63017BF8-D681-45EC-9C31-09D029F1126D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "71892EC0-E6B1-4214-AC53-06489F711829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "8E0B1791-974A-4967-8CF9-33BE8183200B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "696F52AE-FEB9-4090-872E-FDFD969F5604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "7B12A8B1-F78E-46B3-8872-4C6484345477",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "DCED03B6-7565-4F53-8D85-F3391BF66988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*",
"matchCriteriaId": "CB2FB0E9-3812-49C5-94F4-3B39D5BE2EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp5:express:*:*:*:*:*",
"matchCriteriaId": "B70F0353-635F-465B-A7E5-AF2D017AB008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*",
"matchCriteriaId": "6B091903-943F-4822-9F24-9D109B2D76A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*",
"matchCriteriaId": "C4DACAC1-ABEC-4310-A0FF-B69EF9BCF273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:6.1:sp7:express:*:*:*:*:*",
"matchCriteriaId": "F77E777F-7EB5-4A08-9063-C772B49B5E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*",
"matchCriteriaId": "B46A3EBE-B268-427E-AAB5-62DDF255F1D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp6:express:*:*:*:*:*",
"matchCriteriaId": "A3024422-1CA9-4E5D-80D1-2F4B57FDAEBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors."
}
],
"id": "CVE-2006-0422",
"lastModified": "2024-11-21T00:06:25.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-01-25T23:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/166"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24294"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18592"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1015528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0313"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24294"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-31 05:00
Modified
2024-11-21 00:05
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev2dev.bea.com/pub/advisory/146 | Patch, Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/17138 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev2dev.bea.com/pub/advisory/146 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/17138 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15052 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:express:*:*:*:*:*",
"matchCriteriaId": "FBDF3AC0-0680-4EEE-898C-47D194667BE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:express:*:*:*:*:*",
"matchCriteriaId": "BBDB9094-78E8-4CBF-9F5F-321D5174F1EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:express:*:*:*:*:*",
"matchCriteriaId": "6FB8930F-C6D8-40B9-8D08-751F5B47229B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:express:*:*:*:*:*",
"matchCriteriaId": "D59F9859-7344-43F0-9348-E57FABB9E431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:express:*:*:*:*:*",
"matchCriteriaId": "0A4EC87D-EF83-48C5-B516-A6A482D9F525",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:express:*:*:*:*:*",
"matchCriteriaId": "6BBA04D4-BA2E-4495-85DE-38918A878012",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:express:*:*:*:*:*",
"matchCriteriaId": "ADED8968-EA9C-4F0E-AD2F-BC834F4D8A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:express:*:*:*:*:*",
"matchCriteriaId": "F7560131-A6AC-4BBB-AA2D-C7C63AB51226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:express:*:*:*:*:*",
"matchCriteriaId": "893C2387-03E3-4F8E-9029-BC64C64239EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:express:*:*:*:*:*",
"matchCriteriaId": "55661356-58E0-49D3-9C79-B4BB5EBE24CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*",
"matchCriteriaId": "0653ACAC-B0D9-4381-AB23-11D24852A414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp4:express:*:*:*:*:*",
"matchCriteriaId": "107C2FC6-BC60-4817-8A21-14C81DA6DEF5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges."
}
],
"id": "CVE-2005-4756",
"lastModified": "2024-11-21T00:05:06.400",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/146"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/17138"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/15052"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-02-21 01:44
Modified
2024-11-21 00:43
Severity ?
Summary
BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.0 | |
| bea | weblogic_server | 9.1 | |
| bea | weblogic_server | 9.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CA97F1A-49F7-4511-8959-D62155491DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*",
"matchCriteriaId": "0EDB38AA-CAC4-4C89-8484-7C2A75F8038F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCAAE8F1-CB25-4871-BE48-ABF7DFAD8AD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:9.1:*:express:*:*:*:*:*",
"matchCriteriaId": "17280B97-D499-434E-BD89-FD348E9E2E0C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service\u0027s WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks."
},
{
"lang": "es",
"value": "BEA WebLogic Server y WebLogic Express 9.0 y 9.1 muestra el servicio web WSDL y pol\u00edticas de seguridad, esto permite a atacantes remotos obtener informaci\u00f3n sensible y potencialmente lanzar ataques adicionales."
}
],
"id": "CVE-2008-0863",
"lastModified": "2024-11-21T00:43:06.000",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-02-21T01:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://dev2dev.bea.com/pub/advisory/260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1019455"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/0612/references"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-19 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 7.0 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 | |
| bea | weblogic_server | 8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C5AFCF-79D8-4005-B800-B0C6BD461276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6828CE4B-91E8-4688-977F-DC7BC21131C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "E141AA86-C6D0-4FA8-9268-0FB0635DF9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "893D9D88-43C4-4F9F-A364-0585DE6FA9E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D34E2925-DE2A-437F-B349-BD7103F4C37E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "16E3F943-D920-4C0A-8545-5CF7D792011F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E08D4CEA-9ACC-4869-BC87-3524A059914F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*",
"matchCriteriaId": "6F5B2A06-CE19-4A57-9566-09FC1E259CDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D18E22CC-A0FC-4BC7-AD39-2645F57486C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*",
"matchCriteriaId": "9429D939-FCC4-4BA7-90C4-BBEECE7309D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic."
}
],
"id": "CVE-2006-2462",
"lastModified": "2024-11-21T00:11:21.910",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-19T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/195"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016103"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://dev2dev.bea.com/pub/advisory/195"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1016103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26458"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}