CVSS: 5.1EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0715
https://notcve.org/view.php?id=CVE-2004-0715
The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges. El proveedor de Autenticación WebLogic en BEA WebLogic Server y WebLogic Express 8.1 hasta SP2 y 7.0 hasta SP4 no elimina relaciones entre miembros cuando se borra un grupo, lo que puede causar que un nuevo grupo con el mismo nombre tenga miembros del grupo antiguo, lo que permite a miembros del grupo ganar privilegios. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp http://secunia.com/advisories/11356 http://securitytracker.com/id?1009763 http://www.kb.cert.org/vuls/id/470470 http://www.osvdb.org/5299 http://www.securityfocus.com/bid/10130 https://exchange.xforce.ibmcloud.com/vulnerabilities/15861 •
CVSS: 7.2EPSS: 0%CPEs: 37EXPL: 0CVE-2004-0652
https://notcve.org/view.php?id=CVE-2004-0652
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods. BEA WebLogic Server y WebLogic Express 7.0 a 7.0 Service Pack 4, y 8.1 a 8.1 Service Pack 2 permiten a atacantes obtener el nombre de usuario y contraseña para arrancar el servidor accediendo directamente a ciertos métodos internos. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp http://secunia.com/advisories/11359 http://securitytracker.com/id?1009766 http://www.kb.cert.org/vuls/id/352110 http://www.osvdb.org/5296 http://www.securityfocus.com/bid/10133 https://exchange.xforce.ibmcloud.com/vulnerabilities/15865 •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2004-0471
https://notcve.org/view.php?id=CVE-2004-0471
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown). BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2 no hace cumplir las restricciones de sitio para iniciar y parar servidores a usuarios en los papeles de seguridad Admin y Operator, lo que permite a usuarios no autorizados causar una denegación de servicio (parada del servicio) • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp http://secunia.com/advisories/11594 http://securitytracker.com/id?1010129 http://www.osvdb.org/6077 http://www.securityfocus.com/bid/10327 https://exchange.xforce.ibmcloud.com/vulnerabilities/16121 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2004-0470
https://notcve.org/view.php?id=CVE-2004-0470
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application. BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2, cuando se edita weblogic.xml usando WebLocic Builder o el método SecurityRoleAssignmentMBean.toXML, quita de manera inadvertida etiquetas de asignación de papel de seguridad cuando weblogic.xml no tiene una etiqueta de nombre principal, lo que puede eliminar las restricciones de acceso pretendidas para la aplicación web asociada. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp http://secunia.com/advisories/11593 http://securitytracker.com/id?1010128 http://www.kb.cert.org/vuls/id/950070 http://www.osvdb.org/6076 http://www.securityfocus.com/bid/10328 https://exchange.xforce.ibmcloud.com/vulnerabilities/16123 •
CVSS: 4.6EPSS: 0%CPEs: 37EXPL: 0CVE-2004-1758
https://notcve.org/view.php?id=CVE-2004-1758
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp http://secunia.com/advisories/11357 http://securitytracker.com/id?1009764 http://www.kb.cert.org/vuls/id/920238 http://www.osvdb.org/5297 http://www.securityfocus.com/bid/10131 https://exchange.xforce.ibmcloud.com/vulnerabilities/15860 •