CVSS: 4.6EPSS: 5%CPEs: 14EXPL: 0CVE-2007-2701
https://notcve.org/view.php?id=CVE-2007-2701
The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue." El JMS Message Bridge en BEA WebLogic Server 7.0 hasta SP7 y 8.1 hasta Service Pack 6, cuando es configurado sin un nombre de usuario y una contraseña, o cuando la URL de conexión no esta definida, permite a atacantes remotos evitar la política de acceso de seguridad y "enviar mensajes sin autorizar a una cola protegida". • http://dev2dev.bea.com/pub/advisory/234 http://osvdb.org/36067 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34287 •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2007-2699 – Oracle Application Testing Suite WebLogic Server Administration Console War Deployment
https://notcve.org/view.php?id=CVE-2007-2699
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files. La Consola de Administración en BEA WebLogic Express y WebLogic Server 9.0 y 9.1 no hace cumplir correctamente ciertas Políticas de Seguridad del Dominio, lo cual permite a usuarios administradores remotos en el rol de Desplegador (Deployer) enviar ficheros de su elección. • http://dev2dev.bea.com/pub/advisory/231 http://osvdb.org/36069 http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 - •
CVSS: 5.1EPSS: 2%CPEs: 48EXPL: 0CVE-2007-2695
https://notcve.org/view.php?id=CVE-2007-2695
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Los servlets HttpClusterServlet y HttpProxyServlet en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0, y 9.1, cuando SecureProxy está habitilitado, pueden procesar "peticiones externas de parte de una identidad de sistema", lo cual permite a atacantes remotos acceder a datos o funcionalidades de administración. • http://dev2dev.bea.com/pub/advisory/227 http://dev2dev.bea.com/pub/advisory/274 http://osvdb.org/36074 http://secunia.com/advisories/25284 http://secunia.com/advisories/29041 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 http://www.vupen.com/english/advisories/2008/0612/references https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-2698
https://notcve.org/view.php?id=CVE-2007-2698
The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information. La Consola de Administración en BEA WebLogic Server 9.0 puede mostrar los atributos del Servicio Web en texto plano durante la configuración, lo cual permite a atacantes remotos obtener información credencial sensible. • http://dev2dev.bea.com/pub/advisory/230 http://osvdb.org/36071 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34286 •
CVSS: 6.8EPSS: 3%CPEs: 21EXPL: 0CVE-2007-2696
https://notcve.org/view.php?id=CVE-2007-2696
The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server. El Servidor JMS en BEA WebLogic Server 6.1 hasta SP7, 7.0 hasta SP6, y 8.1 hasta SP5 hace cumplir políticas de acceso de seguridad en la interfaz frontal (front end), lo cual permite a atacantes remotos acceder a colas protegidas mediante peticiones directas al servidor JMS interno (back-end server). • http://dev2dev.bea.com/pub/advisory/228 http://osvdb.org/36073 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34284 •