CVSS: 10.0EPSS: 94%CPEs: 72EXPL: 2CVE-2008-3257 – Bea Weblogic Apache Connector - Code Execution / Denial of Service
https://notcve.org/view.php?id=CVE-2008-3257
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request. Desbordamiento de búfer basado en pila en Apache Connector (mod_wl) en Oracle WebLogic Server (anteriormente BEA Weblogic Server) 10.3 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de una cadena larga HTTP, como se ha demostrado mediante una cadena después del "POST /.jsp" en una petición HTTP. NOTA: es probable que esta vulnerabilidad se solape con el CVE-2008-2579 u otra vulnerabilidad revelada en los avisos de Oracle CPUJul2008. • https://www.exploit-db.com/exploits/6089 https://www.exploit-db.com/exploits/18897 http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html http://secunia.com/advisories/31146 http://www.attrition.org/pipermail/vim/2008-July/002035.html http://www.attrition.org/pipermail/vim/2008-July/002036.html http://www.kb.cert.org/vuls/id/716387 http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html http://www.securityfocus.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 99EXPL: 0CVE-2008-2579
https://notcve.org/view.php?id=CVE-2008-2579
Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors. Una vulnerabilidad no especificada en el componente WebLogic Server Plugins para Apache, servidores web Sun e IIS en BEA Product Suite de Oracle versiones 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7 y 6.1 SP7, presenta un impacto desconocido y vectores de ataque remotos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://jvn.jp/en/jp/JVN81667751/index.html http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000040.html http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020498 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 https&# •
CVSS: 6.4EPSS: 0%CPEs: 27EXPL: 0CVE-2008-0895
https://notcve.org/view.php?id=CVE-2008-0895
BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers. BEA WebLogic Server y WebLogic Express de 6.1 a 10.0 permite a atacantes remotos evitar la autentificación para servlets de aplicación a través de cabeceras de petición modificadas. • http://dev2dev.bea.com/pub/advisory/265 http://secunia.com/advisories/29041 http://www.securitytracker.com/id?1019443 http://www.vupen.com/english/advisories/2008/0612/references • CWE-287: Improper Authentication •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2008-0901
https://notcve.org/view.php?id=CVE-2008-0901
BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not. BEA WebLogic Server y Express de 7.0 a 10.0 permite a atacantes remotos llevar a cabo ataques para adivinar contraseñas mediante fuerza bruta, incluso cuando se ha activado el cierre de cuenta, a través de URLs manipulados que indican si la contraseña supuesta es buena o no. • http://dev2dev.bea.com/pub/advisory/271 http://secunia.com/advisories/29041 http://www.s21sec.com/avisos/s21sec-040-en.txt http://www.securityfocus.com/archive/1/488686/100/0/threaded http://www.securitytracker.com/id?1019449 http://www.vupen.com/english/advisories/2008/0612/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0CVE-2008-0902
https://notcve.org/view.php?id=CVE-2008-0902
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Server y Express de 6.1 a 10.0 MP1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de muestras no especificadas. NOTA: podría ser la misma vulnerabilidad que CVE-2007-2694. • http://dev2dev.bea.com/pub/advisory/273 http://secunia.com/advisories/29041 http://www.vupen.com/english/advisories/2008/0612/references • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •