CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2008-0869
https://notcve.org/view.php?id=CVE-2008-0869
21 Feb 2008 — Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Workshop de 8.1 a SP6 y Workshop para WebLogic de 9.0 a 10.0 permite a atacantes remotos inyectar secuencias de comand... • http://dev2dev.bea.com/pub/advisory/263 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2008-0870
https://notcve.org/view.php?id=CVE-2008-0870
21 Feb 2008 — BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session. BEA WebLogic Portal 10.0 y 9.2 desde el Maintenance Pack 2, bajo determinadas circunstancias, puede redireccionar a un usuario desde la URI https:// de la consola del Portal de Administración a una URI http://, que permitiría a atacantes remotos capturar la sesión. • http://dev2dev.bea.com/pub/advisory/264 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •