Unscored severity · published Feb 21, 2008
CVE-2008-0866
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject arbitrary web script or HTML via an invalid action URI, which is not…
–
CVSS
1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject arbitrary web script or HTML via an invalid action URI, which is not properly handled by NetUI page flows.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WW
Weblogic Workshop · Bea
8.1; 8.1; 8.1; 8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0866
dev2dev.bea.com
http://dev2dev.bea.com/pub/advisory/258
secunia.com
http://secunia.com/advisories/29041
www.securitytracker.com
http://www.securitytracker.com/id?1019441
www.vupen.com
http://www.vupen.com/english/advisories/2008/0611
More from Weblogic Workshop
–
CVE-2008-0869
Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script…
–
CVE-2007-5576
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain…
–
CVE-2007-2705
Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded…