CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3213
https://notcve.org/view.php?id=CVE-2018-3213
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Docker Images). The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105633 http://www.securitytracker.com/id/1041896 https://www.tenable.com/security/research/tra-2018-32 •
CVSS: 10.0EPSS: 94%CPEs: 72EXPL: 2CVE-2008-3257 – Bea Weblogic Apache Connector - Code Execution / Denial of Service
https://notcve.org/view.php?id=CVE-2008-3257
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request. Desbordamiento de búfer basado en pila en Apache Connector (mod_wl) en Oracle WebLogic Server (anteriormente BEA Weblogic Server) 10.3 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de una cadena larga HTTP, como se ha demostrado mediante una cadena después del "POST /.jsp" en una petición HTTP. NOTA: es probable que esta vulnerabilidad se solape con el CVE-2008-2579 u otra vulnerabilidad revelada en los avisos de Oracle CPUJul2008. • https://www.exploit-db.com/exploits/6089 https://www.exploit-db.com/exploits/18897 http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.html http://secunia.com/advisories/31146 http://www.attrition.org/pipermail/vim/2008-July/002035.html http://www.attrition.org/pipermail/vim/2008-July/002036.html http://www.kb.cert.org/vuls/id/716387 http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html http://www.securityfocus.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0903
https://notcve.org/view.php?id=CVE-2008-0903
Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL. Vulnerabilidad no especificada en el plugin BEA WebLogic Server y Express proxy, como se distribuyó antes de Noviembre de 2007 y antes de 9.2 MP3 y 10.0 MP2, permite a atacantes remotos provocar una denegación de servicio (caída del servidor web) a través de un URL manipulado. • http://dev2dev.bea.com/pub/advisory/275 http://secunia.com/advisories/29041 http://www.securitytracker.com/id?1019450 http://www.vupen.com/english/advisories/2008/0608/references •
CVSS: 6.4EPSS: 1%CPEs: 10EXPL: 0CVE-2007-4615
https://notcve.org/view.php?id=CVE-2007-4615
The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications. La implementación del cliente SSL en el BEA WebLogic Server 7.0 SP7, el 8.1 SP2 hasta el SP6, el 9.0, el 9.1, el 9.2 Gold hasta el MP2 y el 10.0, selecciona algunas veces una clave nula cuando otras están habilitadas, lo que puede permitir a atacantes remotos interceptar las comunicaciones. • http://dev2dev.bea.com/pub/advisory/244 http://secunia.com/advisories/26539 http://securitytracker.com/id?1018619 http://www.securityfocus.com/bid/25472 http://www.vupen.com/english/advisories/2007/3008 https://exchange.xforce.ibmcloud.com/vulnerabilities/36322 •
CVSS: 1.5EPSS: 0%CPEs: 5EXPL: 0CVE-2007-0409
https://notcve.org/view.php?id=CVE-2007-0409
BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password. BEA WebLogic 7.0 hasta 7.0 SP6, 8.1 hasta 8.1 SP4, y 9.0 lanzamiento inicial no encripta las contraseñas almacenadas en JDBCDataSourceFactory MBean Properties, lo cual permite a usuarios administrativos locales leer las contraseñas en texto plano. • http://dev2dev.bea.com/pub/advisory/203 http://osvdb.org/38501 http://secunia.com/advisories/23750 http://securitytracker.com/id?1017525 http://www.securityfocus.com/bid/22082 http://www.vupen.com/english/advisories/2007/0213 •