WS
Product
Weblogic Server
149
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 1Low 0
Watch
Add Weblogic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2005-1380 | – | May 3 | Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +9 more |
| CVE-2005-0432 | – | May 2 | BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails,… Affected: 7.0; 8.1 |
| CVE-2004-2696 | – | Dec 31 | BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when… Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more |
| CVE-2004-2424 | – | Dec 31 | BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions,… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +9 more |
| CVE-2004-2321 | – | Dec 31 | BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1)… Affected: 8.1; 8.1; 8.1 |
| CVE-2004-1757 | – | Dec 31 | BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more |
| CVE-2004-0652 | – | Aug 6 | BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +31 more |
| CVE-2004-0204 | – | Aug 6 | Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +3 more |
| CVE-2004-0715 | – | Jul 27 | The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +18 more |
| CVE-2004-0713 | – | Jul 27 | The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not… Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more |
| CVE-2004-0712 | – | Jul 27 | The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +3 more |
| CVE-2004-0711 | – | Jul 27 | The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +15 more |
| CVE-2004-0471 | – | Jul 7 | BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and… Affected: 7.0; 7.0; 8.1; 8.1 |
| CVE-2004-0470 | – | Jul 7 | BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method,… Affected: 7.0; 7.0; 8.1; 8.1 |
| CVE-2004-1758 | – | Apr 13 | BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection… Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +31 more |
| CVE-2004-1756 | – | Apr 13 | BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +14 more |
| CVE-2003-1438 | – | Dec 31 | Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be… Affected: 5.1; 6.0; 6.1; 7.0; 7.0.0.1 |
| CVE-2003-1437 | – | Dec 31 | BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which… Affected: 7.0; 7.0; 7.0.0.1; 7.0.0.1; 7.0; 7.0; +6 more |
| CVE-2003-1290 | – | Dec 31 | BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.1; +34 more |
| CVE-2003-1226 | – | Dec 31 | BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +12 more |
| CVE-2003-1225 | – | Dec 31 | The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +13 more |
| CVE-2003-1224 | – | Dec 31 | Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +16 more |
| CVE-2003-1223 | – | Dec 31 | The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node… Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more |
| CVE-2003-1222 | – | Dec 31 | BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and… Affected: 8.1; 8.1; 8.1; 8.1 |
| CVE-2003-1221 | – | Dec 31 | BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +20 more |
| CVE-2003-1220 | – | Dec 31 | BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed… Affected: 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +34 more |
| CVE-2003-1094 | – | Dec 31 | BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial… Affected: 7.0; 7.0; 7.0 |
| CVE-2003-1093 | – | Dec 31 | BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a… Affected: 6.1; 6.1; 6.1; 6.1; 7.0; 7.0; +1 more |
| CVE-2003-0624 | – | Dec 1 | Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter Affected: through 8.1; 3.1.8 |
| CVE-2003-0623 | – | Dec 1 | Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE… Affected: 4.2; 5.0.1; 5.1 |
| CVE-2003-0622 | – | Dec 1 | The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such… Affected: 4.2; 5.0.1; 5.1 |
| CVE-2003-0621 | – | Dec 1 | The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE… Affected: 4.2; 5.0.1; 5.1 |
| CVE-2003-0733 | – | Oct 20 | Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers… Affected: 5.1; 7.0 |
| CVE-2003-0640 | – | Aug 27 | BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators… Affected: All versions, or not specified |
| CVE-2003-0151 | – | Mar 24 | BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +22 more |
| CVE-2003-1095 | – | Mar 18 | BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is… Affected: 7.0; 7.0; 7.0; 7.0; 7.0.0.1; 7.0.0.1; +2 more |
| CVE-2002-2177 | – | Dec 31 | BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow… Affected: 6.1; 6.1; 6.1; 6.1; 7.0; 7.0; +2 more |
| CVE-2002-2142 | – | Dec 31 | An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and… Affected: 6.0; 6.0; 6.1; 6.1; 7.0; 7.0; +2 more |
| CVE-2002-2141 | – | Dec 31 | BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on… Affected: 7.0; 7.0; 7.0.0.1; 7.0.0.1 |
| CVE-2002-1030 | – | Oct 4 | Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data… Affected: 5.1; 5.1; 5.1; 5.1; 5.1; 5.1; +34 more |
| CVE-2002-0106 | – | Mar 25 | BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name Affected: 6.1; 6.1 |
| CVE-2001-0098 | – | Feb 12 | Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string Affected: through 4.5.2 |
| CVE-2000-1238 | – | Dec 31 | BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple /… Affected: 5.1; 5.1; 5.1; 5.1; 5.1; 5.1; +8 more |
| CVE-2000-0685 | – | Oct 20 | BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the… Affected: 3.1.8; 4.0.4; 4.5.1 |
| CVE-2000-0684 | – | Oct 20 | BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on… Affected: 3.1.8; 4.0.4; 4.5.1 |
| CVE-2000-0683 | – | Oct 20 | BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet Affected: 5.1; 5.1; 5.1; 5.1; 5.1; 5.1; +9 more |
| CVE-2000-0682 | – | Oct 20 | BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet Affected: 5.1; 5.1; 5.1; 5.1; 5.1; 5.1; +9 more |
| CVE-2000-0681 | – | Oct 20 | Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension Affected: through 4.5.2 |
| CVE-2000-0500 | – | Jun 21 | The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default… Affected: 3.1.8; 3.1.8; 4.0; 4.0; 4.5; 4.5; +2 more |