CVSS: 7.2EPSS: 0%CPEs: 37EXPL: 0CVE-2004-0652
https://notcve.org/view.php?id=CVE-2004-0652
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods. BEA WebLogic Server y WebLogic Express 7.0 a 7.0 Service Pack 4, y 8.1 a 8.1 Service Pack 2 permiten a atacantes obtener el nombre de usuario y contraseña para arrancar el servidor accediendo directamente a ciertos métodos internos. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp http://secunia.com/advisories/11359 http://securitytracker.com/id?1009766 http://www.kb.cert.org/vuls/id/352110 http://www.osvdb.org/5296 http://www.securityfocus.com/bid/10133 https://exchange.xforce.ibmcloud.com/vulnerabilities/15865 •
CVSS: 7.5EPSS: 96%CPEs: 19EXPL: 2CVE-2004-0204 – Business Objects Crystal Reports 9/10 Web Form Viewer - Directory Traversal
https://notcve.org/view.php?id=CVE-2004-0204
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx. Vulnerabilidad de atravesamiento de directorios en los visores web de Business Objects Crystal Reports 9 and 10, y Crystal Enterprise 9 o 10, usados en Visual Studio .NET 2003 y Outlook 2003 con Business Contact Manager, Microsoft Business Solutions CRM 1.2, y otros productos, permiten a atacantes remotos leer y borrar ficheros de su elección mediante secuencias ".." en el argumento dynamicimag de crystalimagehandler.aspx. • https://www.exploit-db.com/exploits/24077 http://marc.info/?l=bugtraq&m=108360413811017&w=2 http://marc.info/?l=bugtraq&m=108671836127360&w=2 http://secunia.com/advisories/11800 http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp http://www.osvdb.org/6748 http://www.securityfocus.com/bid/10260 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017 https://exchange.xforce.ibmcloud.com/vulnerabilities/16044 https:/&# •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2004-0471
https://notcve.org/view.php?id=CVE-2004-0471
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown). BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2 no hace cumplir las restricciones de sitio para iniciar y parar servidores a usuarios en los papeles de seguridad Admin y Operator, lo que permite a usuarios no autorizados causar una denegación de servicio (parada del servicio) • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp http://secunia.com/advisories/11594 http://securitytracker.com/id?1010129 http://www.osvdb.org/6077 http://www.securityfocus.com/bid/10327 https://exchange.xforce.ibmcloud.com/vulnerabilities/16121 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2004-0470
https://notcve.org/view.php?id=CVE-2004-0470
BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application. BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2, cuando se edita weblogic.xml usando WebLocic Builder o el método SecurityRoleAssignmentMBean.toXML, quita de manera inadvertida etiquetas de asignación de papel de seguridad cuando weblogic.xml no tiene una etiqueta de nombre principal, lo que puede eliminar las restricciones de acceso pretendidas para la aplicación web asociada. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp http://secunia.com/advisories/11593 http://securitytracker.com/id?1010128 http://www.kb.cert.org/vuls/id/950070 http://www.osvdb.org/6076 http://www.securityfocus.com/bid/10328 https://exchange.xforce.ibmcloud.com/vulnerabilities/16123 •
CVSS: 4.6EPSS: 0%CPEs: 37EXPL: 0CVE-2004-1758
https://notcve.org/view.php?id=CVE-2004-1758
BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_53.00.jsp http://secunia.com/advisories/11357 http://securitytracker.com/id?1009764 http://www.kb.cert.org/vuls/id/920238 http://www.osvdb.org/5297 http://www.securityfocus.com/bid/10131 https://exchange.xforce.ibmcloud.com/vulnerabilities/15860 •