CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2003-0640
https://notcve.org/view.php?id=CVE-2003-0640
BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges. BEA WebLogic Server y Express, cuando usa NodeManager para iniciar servidores, provee al usuarios Operadores con privilegios para sobreesctibir nombres de usuario y contraseñas, lo que puede permitir a Operadores ganar privielgios de Admin. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-33.jsp http://www.secunia.com/advisories/9232 •
CVSS: 7.5EPSS: 8%CPEs: 28EXPL: 0CVE-2003-0151
https://notcve.org/view.php?id=CVE-2003-0151
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code. BEA Weblogic Server y Express 6.0 a 7.0 no restringe adecuadamente el acceso a ciertos servlets internos que llevan a cabo funciones administrativas, lo que permite a atacantes remotos leer ficheros arbitrarios o ejecutar código arbitrario. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp http://marc.info/?l=bugtraq&m=104792477914620&w=2 http://marc.info/?l=bugtraq&m=104792544515384&w=2 http://www.s21sec.com/en/avisos/s21sec-011-en.txt http://www.securityfocus.com/bid/7122 http://www.securityfocus.com/bid/7124 •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2003-1095
https://notcve.org/view.php?id=CVE-2003-1095
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp http://www.kb.cert.org/vuls/id/691153 http://www.securityfocus.com/bid/7130 https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2002-2141
https://notcve.org/view.php?id=CVE-2002-2141
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove the security constraints and roles on all servers for any Servlets or EJB that are used by an application that is undeployed on one server, which could allow remote attackers to conduct unauthorized activities in violation of the intended restrictions. • http://dev2dev.bea.com/pub/advisory/39 http://www.iss.net/security_center/static/10291.php http://www.securityfocus.com/bid/5846 •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2002-2142
https://notcve.org/view.php?id=CVE-2002-2142
An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Service Pack 1 from BEA WebLogic Server and Express 6.0 through 7.0.0.1, does not prepend a "/" character in certain URL patterns, which prevents the proper enforcement of role mappings and policies in applications that use the extension. • http://dev2dev.bea.com/pub/advisory/3 http://www.iss.net/security_center/static/10392.php http://www.securityfocus.com/bid/5971 •