Browse CVEs

MEDIUM 5.0 CVE-2004-1756 BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a… Weblogic Server Patch available Fix from $1,6002004-04-13 HIGH 7.2 CVE-2003-1094 BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the freq… Weblogic Server Patch available Fix from $1,9502003-12-31 MEDIUM 5.0 CVE-2003-1220 BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy… Weblogic Server Patch available Fix from $1,6002003-12-31 MEDIUM 5.0 CVE-2003-1221 BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 … Weblogic Server Patch available Fix from $1,6002003-12-31 MEDIUM 5.0 CVE-2003-1222 BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign p… Weblogic Server Patch available Fix from $1,6002003-12-31 MEDIUM 5.0 CVE-2003-1223 The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) v… Weblogic Server Patch available Fix from $1,6002003-12-31 MEDIUM 5.0 CVE-2003-1290 BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configurat… Weblogic Server Patch available Fix from $1,6002003-12-31 MEDIUM 5.0 CVE-2003-0621EPSS 7% The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modifi… Tuxedo Patch available Fix from $1,6002003-12-01 MEDIUM 5.0 CVE-2003-0622 The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that con… Tuxedo Patch available Fix from $1,6002003-12-01 MEDIUM 6.8 CVE-2003-0733 Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through… Liquid Data Patch available Fix from $1,6002003-10-20 HIGH 10.0 CVE-2003-0640 BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and password… Weblogic Server Patch available Fix from $1,9502003-08-27 HIGH 7.5 CVE-2003-0151 BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions,… Weblogic Server Mitigation only Fix from $1,9502003-03-24 HIGH 7.5 CVE-2002-2141 BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the securi… Weblogic Server Mitigation only Fix from $1,9502002-12-31 HIGH 7.5 CVE-2002-2142 An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1… Weblogic Integration Patch available Fix from $1,9502002-12-31 MEDIUM 5.0 CVE-2002-0106EPSS 7% BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS de… Weblogic Server Patch available Fix from $1,6002002-03-25 HIGH 10.0 CVE-2001-0098EPSS 78% Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." str… Weblogic Server after 4.5.2 Fix from $1,9502001-02-12 HIGH 7.5 CVE-2000-1238 BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages vi… Weblogic Server Patch available Fix from $1,9502000-12-31 HIGH 10.0 CVE-2000-0681EPSS 51% Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension. Weblogic Server after 4.5.2 Fix from $1,9502000-10-20 HIGH 10.0 CVE-2000-0684EPSS 12% BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by di… Weblogic Server Patch available Fix from $1,9502000-10-20 HIGH 10.0 CVE-2000-0685EPSS 12% BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML … Weblogic Server Patch available Fix from $1,9502000-10-20 MEDIUM 5.0 CVE-2000-0682 BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServle… Weblogic Server Patch available Fix from $1,6002000-10-20 MEDIUM 5.0 CVE-2000-0683 BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet. Weblogic Server Patch available Fix from $1,6002000-10-20 MEDIUM 5.0 CVE-2000-0500 The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, w… Weblogic Server Patch available Fix from $1,6002000-06-21 HIGH 7.5 CVE-2000-0499 The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which… Weblogic Server after 4.5.1 Fix from $1,9502000-06-08