CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2007-2699 – Oracle Application Testing Suite WebLogic Server Administration Console War Deployment
https://notcve.org/view.php?id=CVE-2007-2699
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files. La Consola de Administración en BEA WebLogic Express y WebLogic Server 9.0 y 9.1 no hace cumplir correctamente ciertas Políticas de Seguridad del Dominio, lo cual permite a usuarios administradores remotos en el rol de Desplegador (Deployer) enviar ficheros de su elección. • http://dev2dev.bea.com/pub/advisory/231 http://osvdb.org/36069 http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 - •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-2698
https://notcve.org/view.php?id=CVE-2007-2698
The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information. La Consola de Administración en BEA WebLogic Server 9.0 puede mostrar los atributos del Servicio Web en texto plano durante la configuración, lo cual permite a atacantes remotos obtener información credencial sensible. • http://dev2dev.bea.com/pub/advisory/230 http://osvdb.org/36071 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34286 •
CVSS: 5.4EPSS: 2%CPEs: 3EXPL: 0CVE-2007-2704
https://notcve.org/view.php?id=CVE-2007-2704
BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket. BEA WebLogic Server 9.0 hasta 9.2 permite a atacantes remotos causar una denegación de servicio (indisponibilidad de puerto SSL) teniendo acceso a un socket SSL a medio cerrar. • http://dev2dev.bea.com/pub/advisory/237 http://osvdb.org/36064 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34278 •
CVSS: 5.1EPSS: 1%CPEs: 33EXPL: 0CVE-2007-2697
https://notcve.org/view.php?id=CVE-2007-2697
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. El servidor LDAP embebido en BEA WebLogic Express y WebLogic Server 7.0 hasta SP6, 8.1 hasta SP5, 9.0, y 9.1, en configuraciones concretas, no limita o monitoriza intentos fallidos de autenticación, lo cual permite a atacantes remotos llevar a cabo ataques de fuerza bruta contra la contraseña del administrador más fácilmente, o inundar el servidor con intentos de identificación y causar una denegación de servicio. • http://dev2dev.bea.com/pub/advisory/229 http://osvdb.org/36072 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34291 •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2007-2694
https://notcve.org/view.php?id=CVE-2007-2694
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0 GA, y 9.1 GA permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://dev2dev.bea.com/pub/advisory/232 http://osvdb.org/36075 http://secunia.com/advisories/25284 http://www.vupen.com/english/advisories/2007/1815 •