CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0896
https://notcve.org/view.php?id=CVE-2008-0896
BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions. BEA WebLogic Portal 10.0 y de 9.2 a MP1, cuando un administrador elimina una instancia única de un portlet de contenido, elimina las políticas de derechos para otros portlets de contenido, lo que permite a atacantes evitar las restricciones de acceso previstas. • http://dev2dev.bea.com/pub/advisory/266 http://secunia.com/advisories/29041 http://www.securitytracker.com/id?1019453 http://www.vupen.com/english/advisories/2008/0613 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0868
https://notcve.org/view.php?id=CVE-2008-0868
Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados en BEA WebLogic Portal 10.0 y 9.2 desde el Maintenance Pack 1, que permite a usuarios autentificados remotamente inyectar secuencias de comandos web o HTML de su elección a través de vectores desconocidos. • http://dev2dev.bea.com/pub/advisory/261 http://secunia.com/advisories/29041 http://www.securitytracker.com/id?1019452 http://www.vupen.com/english/advisories/2008/0613 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2008-0870
https://notcve.org/view.php?id=CVE-2008-0870
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session. BEA WebLogic Portal 10.0 y 9.2 desde el Maintenance Pack 2, bajo determinadas circunstancias, puede redireccionar a un usuario desde la URI https:// de la consola del Portal de Administración a una URI http://, que permitiría a atacantes remotos capturar la sesión. • http://dev2dev.bea.com/pub/advisory/264 http://secunia.com/advisories/29041 http://www.securitytracker.com/id?1019442 http://www.vupen.com/english/advisories/2008/0613 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.8EPSS: 0%CPEs: 56EXPL: 0CVE-2007-5576
https://notcve.org/view.php?id=CVE-2007-5576
BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands. BEA Tuxedo 8.0 anterior al RP392 y el 8.1 anterior al RP293 y el WebLogic Enterprise 5.1 anterior al RP174, muestra la contraseña en texto claro, lo que permite a atacantes físicamente próximos obtener información sensible a través de los comandos (1) cnsbind, (2) cnsunbind o (3) cnsls. • http://dev2dev.bea.com/pub/advisory/226 http://osvdb.org/45478 http://www.vupen.com/english/advisories/2007/1813 https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-2702
https://notcve.org/view.php?id=CVE-2007-2702
Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en la aplicación GroupSpace de BEA WebLogic Portal 9.2 GA permite a usuarios remotos autenticados inyectar secuencias de comandos (script) web o HTML de su elección a través de vectores sin especificar relacionados con el editor de texto enriquecido. • http://dev2dev.bea.com/pub/advisory/235 http://osvdb.org/36066 http://secunia.com/advisories/25284 http://www.securitytracker.com/id?1018060 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34283 •