CVSS: 6.4EPSS: 1%CPEs: 10EXPL: 0CVE-2007-4615
https://notcve.org/view.php?id=CVE-2007-4615
The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications. La implementación del cliente SSL en el BEA WebLogic Server 7.0 SP7, el 8.1 SP2 hasta el SP6, el 9.0, el 9.1, el 9.2 Gold hasta el MP2 y el 10.0, selecciona algunas veces una clave nula cuando otras están habilitadas, lo que puede permitir a atacantes remotos interceptar las comunicaciones. • http://dev2dev.bea.com/pub/advisory/244 http://secunia.com/advisories/26539 http://securitytracker.com/id?1018619 http://www.securityfocus.com/bid/25472 http://www.vupen.com/english/advisories/2007/3008 https://exchange.xforce.ibmcloud.com/vulnerabilities/36322 •
CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0CVE-2007-2700
https://notcve.org/view.php?id=CVE-2007-2700
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information. La secuencia de comandos (script) WLST generada por el comando configToScript en BEA WebLogic Express y WebLogic Server 9.0 y 9.1 no cifra determinados atributos en los ficheros de configuración cuando crea un nuevo dominio, lo cual permite a usuarios remotos autenticados obtener información sensible. • http://dev2dev.bea.com/pub/advisory/233 http://osvdb.org/36068 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34288 •
CVSS: 5.4EPSS: 2%CPEs: 3EXPL: 0CVE-2007-2704
https://notcve.org/view.php?id=CVE-2007-2704
BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket. BEA WebLogic Server 9.0 hasta 9.2 permite a atacantes remotos causar una denegación de servicio (indisponibilidad de puerto SSL) teniendo acceso a un socket SSL a medio cerrar. • http://dev2dev.bea.com/pub/advisory/237 http://osvdb.org/36064 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34278 •
CVSS: 5.1EPSS: 1%CPEs: 33EXPL: 0CVE-2007-2697
https://notcve.org/view.php?id=CVE-2007-2697
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. El servidor LDAP embebido en BEA WebLogic Express y WebLogic Server 7.0 hasta SP6, 8.1 hasta SP5, 9.0, y 9.1, en configuraciones concretas, no limita o monitoriza intentos fallidos de autenticación, lo cual permite a atacantes remotos llevar a cabo ataques de fuerza bruta contra la contraseña del administrador más fácilmente, o inundar el servidor con intentos de identificación y causar una denegación de servicio. • http://dev2dev.bea.com/pub/advisory/229 http://osvdb.org/36072 http://secunia.com/advisories/25284 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 https://exchange.xforce.ibmcloud.com/vulnerabilities/34291 •
CVSS: 5.1EPSS: 2%CPEs: 48EXPL: 0CVE-2007-2695
https://notcve.org/view.php?id=CVE-2007-2695
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Los servlets HttpClusterServlet y HttpProxyServlet en BEA WebLogic Express y WebLogic Server 6.1 hasta SP7, 7.0 hasta SP7, 8.1 hasta SP5, 9.0, y 9.1, cuando SecureProxy está habitilitado, pueden procesar "peticiones externas de parte de una identidad de sistema", lo cual permite a atacantes remotos acceder a datos o funcionalidades de administración. • http://dev2dev.bea.com/pub/advisory/227 http://dev2dev.bea.com/pub/advisory/274 http://osvdb.org/36074 http://secunia.com/advisories/25284 http://secunia.com/advisories/29041 http://securitytracker.com/id?1018057 http://www.vupen.com/english/advisories/2007/1815 http://www.vupen.com/english/advisories/2008/0612/references https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 •