CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 2CVE-2003-0621 – BEA Tuxedo 6/7/8 and WebLogic Enterprise 4/5 - Input Validation
https://notcve.org/view.php?id=CVE-2003-0621
The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument. La consola de adminstración de BEA Tuxedo 8.1 y anteriores permite a atacantes remotos determinar la existencia de ficheros fuera de la raíz web mediante rutas modificadas en el argumento INFILE. • https://www.exploit-db.com/exploits/23312 http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp http://marc.info/?l=bugtraq&m=106762000607681&w=2 http://www.securityfocus.com/bid/8931 https://exchange.xforce.ibmcloud.com/vulnerabilities/13559 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2003-0624 – BEA WebLogic 6/7/8 - InteractiveQuery.jsp Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2003-0624
Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter. Vulnerabilidad de scripts en sitios cruzados en Interactive.jsp de BEA WebLogic 8.1 y anteriores permite a atacantes remotos inyectar script web malicioso mediante el parámetro person. • https://www.exploit-db.com/exploits/23315 http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp http://marc.info/?l=bugtraq&m=106761926906781&w=2 http://www.securityfocus.com/bid/8938 https://exchange.xforce.ibmcloud.com/vulnerabilities/13568 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2003-0733
https://notcve.org/view.php?id=CVE-2003-0733
Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and WebLogic Server and Express 5.1 through 7.0, allow remote attackers to execute arbitrary web script and steal authentication credentials via (1) a forward instruction to the Servlet container or (2) other vulnerabilities in the WebLogic Server console application. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/SA_BEA03_36.00.jsp http://www.securityfocus.com/bid/8357 •
CVSS: 7.5EPSS: 8%CPEs: 28EXPL: 0CVE-2003-0151
https://notcve.org/view.php?id=CVE-2003-0151
BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code. BEA Weblogic Server y Express 6.0 a 7.0 no restringe adecuadamente el acceso a ciertos servlets internos que llevan a cabo funciones administrativas, lo que permite a atacantes remotos leer ficheros arbitrarios o ejecutar código arbitrario. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp http://marc.info/?l=bugtraq&m=104792477914620&w=2 http://marc.info/?l=bugtraq&m=104792544515384&w=2 http://www.s21sec.com/en/avisos/s21sec-011-en.txt http://www.securityfocus.com/bid/7122 http://www.securityfocus.com/bid/7124 •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2003-1095
https://notcve.org/view.php?id=CVE-2003-1095
BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-27.jsp http://www.kb.cert.org/vuls/id/691153 http://www.securityfocus.com/bid/7130 https://exchange.xforce.ibmcloud.com/vulnerabilities/11555 •