CVSS: 7.8EPSS: 0%CPEs: 46EXPL: 0CVE-2004-1757
https://notcve.org/view.php?id=CVE-2004-1757
31 Dec 2004 — BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp •
CVSS: 5.8EPSS: 7%CPEs: 85EXPL: 0CVE-2004-2320 – Micro Focus Security Bulletin MFSBGN03812 1
https://notcve.org/view.php?id=CVE-2004-2320
31 Dec 2004 — The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting. A potential security vulnerability has been identified in Micro Focus Application Performance Management. The vulnerability could be remotely exploited to remote cross-site tracing ... • http://dev2dev.bea.com/pub/advisory/68 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 61EXPL: 0CVE-2004-2696
https://notcve.org/view.php?id=CVE-2004-2696
31 Dec 2004 — BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call. • http://dev2dev.bea.com/pub/advisory/59 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2004-0711
https://notcve.org/view.php?id=CVE-2004-0711
21 Jul 2004 — The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected. La característica de coincidencia de patrones en URL de WebLogic Server 6.x encuentra coincidencias en patrones ilegales terminados en "*" como comodines como si fueran el patrón legal "/", lo que podría causar q... • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_56.00.jsp •
CVSS: 6.5EPSS: 0%CPEs: 44EXPL: 0CVE-2004-0713
https://notcve.org/view.php?id=CVE-2004-0713
21 Jul 2004 — The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown. El método remove en una Enterprise JavaBean (EJB) con estado en BEA WebLogic Server y WebLogic Express version 8.1 hasta SP2, 7.0 hasta SP4, y 6.1 a SP6, no co... • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_57.00.jsp •
CVSS: 9.8EPSS: 2%CPEs: 24EXPL: 0CVE-2004-0715
https://notcve.org/view.php?id=CVE-2004-0715
21 Jul 2004 — The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges. El proveedor de Autenticación WebLogic en BEA WebLogic Server y WebLogic Express 8.1 hasta SP2 y 7.0 hasta SP4 no elimina relaciones entre miembros cuando se borra un grupo, lo que puede causa... • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_52.01.jsp •
CVSS: 9.1EPSS: 0%CPEs: 37EXPL: 0CVE-2004-0652
https://notcve.org/view.php?id=CVE-2004-0652
13 Jul 2004 — BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods. BEA WebLogic Server y WebLogic Express 7.0 a 7.0 Service Pack 4, y 8.1 a 8.1 Service Pack 2 permiten a atacantes obtener el nombre de usuario y contraseña para arrancar el servidor accediendo directamente a ciertos métodos internos. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp •
CVSS: 9.1EPSS: 2%CPEs: 4EXPL: 0CVE-2004-0470
https://notcve.org/view.php?id=CVE-2004-0470
20 May 2004 — BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application. BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2, cuando se edita weblogic.xml usando WebLocic Builder o el método SecurityRoleA... • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_59.00.jsp •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2004-0471
https://notcve.org/view.php?id=CVE-2004-0471
20 May 2004 — BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown). BEA WebLogic Server y WebLocic Express 7.0 hasta SP5 y 8.1 hasta SP2 no hace cumplir las restricciones de sitio para iniciar y parar servidores a usuarios en los papeles de seguridad Admin y Operator, lo que permite a usuarios no aut... • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_60.00.jsp •
CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 0CVE-2004-1756
https://notcve.org/view.php?id=CVE-2004-1756
13 Apr 2004 — BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_54.00.jsp •