CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2007-0415
https://notcve.org/view.php?id=CVE-2007-0415
23 Jan 2007 — BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions. BEA WebLogic Server 8.1 hasta 8.1 SP5 no fuerza adecuadamente el control de acceso tras una actualización dinámica y un redespliegue dinámico de una aplicación que está implementada a través de jars expandidos, lo cual permite a los atacantes evitar las restr... • http://dev2dev.bea.com/pub/advisory/209 •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2007-0417
https://notcve.org/view.php?id=CVE-2007-0417
23 Jan 2007 — BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity. BEA WebLogic Server 7.0 hasta 7.0 SP7, 8.1 hasta 8.1 SP5, 9.0, y 9.1, cuando se usa el dominio de compatibilidad con WebLogic Server 6.1, permite a los atacantes ejecutar determinadas operaciones de persistencia de contenedores EJB con una identidad administrativa. • http://dev2dev.bea.com/pub/advisory/211 •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2007-0418
https://notcve.org/view.php?id=CVE-2007-0418
23 Jan 2007 — BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods. BEA WebLogic Server 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP5, 9.0, y 9.1 no hace cmplir las políticas de seguridad que declara los permisos para los métodos EJB que tienen parámetros array, lo cual permite a atacantes remotos obtener acceso no autorizado a e... • http://dev2dev.bea.com/pub/advisory/212 •
CVSS: 7.5EPSS: 1%CPEs: 16EXPL: 0CVE-2007-0421
https://notcve.org/view.php?id=CVE-2007-0421
23 Jan 2007 — BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log. BEA WebLogic Server 6.1 hasta 6.1 SP7, y 7.0 hasta 7.0 SP7 permite a atacantes remotos provocar denegación de servicio (consumo de disco) a través de respuestas que contienen cabeceras malformadas, lo cual provoca que una gran cantidad de datos sean escritos en el... • http://dev2dev.bea.com/pub/advisory/215 •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2007-0425
https://notcve.org/view.php?id=CVE-2007-0425
23 Jan 2007 — Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow. Vulnerabilidad no especificada en BEA WebLogic Platform and Server 8.1 hasta 8.1 SP5, y JRockit 1.4.2 R4.5 y anteriores, permite a los atacantes obtener privilegios a través de vectores no especificados, relacionados con una "condición de desbordamiento", probablement... • http://dev2dev.bea.com/pub/advisory/222 •
CVSS: 4.0EPSS: 0%CPEs: 17EXPL: 0CVE-2006-2467
https://notcve.org/view.php?id=CVE-2006-2467
19 May 2006 — BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address. • http://dev2dev.bea.com/pub/advisory/191 •
CVSS: 9.8EPSS: 0%CPEs: 19EXPL: 0CVE-2006-2469
https://notcve.org/view.php?id=CVE-2006-2469
19 May 2006 — The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges. • http://dev2dev.bea.com/pub/advisory/189 •
CVSS: 7.5EPSS: 0%CPEs: 40EXPL: 0CVE-2006-2471
https://notcve.org/view.php?id=CVE-2006-2471
19 May 2006 — Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain "server details" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault. • http://dev2dev.bea.com/pub/advisory/187 •
CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2006-2472
https://notcve.org/view.php?id=CVE-2006-2472
19 May 2006 — Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys. • http://dev2dev.bea.com/pub/advisory/186 •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2006-1351
https://notcve.org/view.php?id=CVE-2006-1351
22 Mar 2006 — BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP. • http://dev2dev.bea.com/pub/advisory/180 •