CVSS: 7.8EPSS: 1%CPEs: 21EXPL: 0CVE-2007-4617
https://notcve.org/view.php?id=CVE-2007-4617
31 Aug 2007 — Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors. Vulnerabilidad sin especificar en el BEA WebLogic Server 6.1 Gold hasta el SP7, el 7.0 Gold hasta el SP7 y el 8.1 Gold hasta el SP4 permite a atacantes remotos provocar una denegación de servicio (cuelgue del hilo del servidor) a través de vectores sin especificar. • http://dev2dev.bea.com/pub/advisory/246 • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 2%CPEs: 16EXPL: 0CVE-2007-4618
https://notcve.org/view.php?id=CVE-2007-4618
31 Aug 2007 — Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers. Vulnerabilidad sin especificar en el BEA WebLogic Server 6.1 Gold hata el SP7 y el 7.0 Gold hasta el SP7, permite a atacantes remotos provocar una denegación de servicio (agotamiento de disco) a través de ciertas cabeceras HTTP malformadas. • http://dev2dev.bea.com/pub/advisory/247 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 48EXPL: 0CVE-2007-2694
https://notcve.org/view.php?id=CVE-2007-2694
16 May 2007 — Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0 GA, y 9.1 GA permite a atacantes remotos inyectar secuencias de comandos web o HTML de su ... • http://dev2dev.bea.com/pub/advisory/232 •
CVSS: 7.5EPSS: 1%CPEs: 48EXPL: 0CVE-2007-2695
https://notcve.org/view.php?id=CVE-2007-2695
16 May 2007 — The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Los servlets HttpClusterServlet y HttpProxyServlet en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0, y 9.1, cuando SecureProxy está habitilitado, ... • http://dev2dev.bea.com/pub/advisory/227 •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2007-2696
https://notcve.org/view.php?id=CVE-2007-2696
16 May 2007 — The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server. El Servidor JMS en BEA WebLogic Server 6.1 hasta SP7, 7.0 hasta SP6, y 8.1 hasta SP5 hace cumplir políticas de acceso de seguridad en la interfaz frontal (front end), lo cual permite a atacantes remotos acceder a colas protegidas mediante peticiones directas al s... • http://dev2dev.bea.com/pub/advisory/228 •
CVSS: 9.1EPSS: 1%CPEs: 33EXPL: 0CVE-2007-2697
https://notcve.org/view.php?id=CVE-2007-2697
16 May 2007 — The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. El servidor LDAP embebido en BEA WebLogic Express y WebLogic Server 7.0 hasta SP6, 8.1 hasta SP5, 9.0, y 9.1, en configuracione... • http://dev2dev.bea.com/pub/advisory/229 •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2007-2701
https://notcve.org/view.php?id=CVE-2007-2701
16 May 2007 — The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue." El JMS Message Bridge en BEA WebLogic Server 7.0 hasta SP7 y 8.1 hasta Service Pack 6, cuando es configurado sin un nombre de usuario y una contraseña, o cuando la URL de conexión no esta definida, permite a at... • http://dev2dev.bea.com/pub/advisory/234 •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2007-0408
https://notcve.org/view.php?id=CVE-2007-0408
23 Jan 2007 — BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate. BEA Weblogic Server 8.1 hasta 8.1 SP4 no valida adecuadamente certificados cliente al reutilizar conexiones cacheadas, lo cual permite a atacantes remotos obtener acceso mediante un certificado X.509 que no es de confianza. • http://dev2dev.bea.com/pub/advisory/202 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2007-0409
https://notcve.org/view.php?id=CVE-2007-0409
23 Jan 2007 — BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password. BEA WebLogic 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP4, y 9.0 lanzamiento inicial no encripta las contraseñas almacenadas en JDBCDataSourceFactory MBean Properties, lo cual permite a usuarios administrativos locales leer las contraseñas en texto plano. • http://dev2dev.bea.com/pub/advisory/203 •
CVSS: 7.5EPSS: 1%CPEs: 15EXPL: 0CVE-2007-0410
https://notcve.org/view.php?id=CVE-2007-0410
23 Jan 2007 — Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events." Vulnerabilidad no especificada en la administración de hilos en BEA WebLogic 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP5, 9.0, y 9.1, cuando se usa la autenticación T3, permite a atacantes remotos provocar una denegación de servicio (cuelgue de hi... • http://dev2dev.bea.com/pub/advisory/204 •