Vulnerabilities > BEA Systems
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-07-13 | CVE-2010-2375 | Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS. | 6.4 |
| 2008-07-22 | CVE-2008-3257 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request. | 10.0 |
| 2008-02-22 | CVE-2008-0904 | Information Exposure vulnerability in BEA Systems Aqualogic Interaction and Plumtree Collaboration Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary files via a crafted URL. | 7.8 |
| 2008-02-22 | CVE-2008-0903 | Denial-Of-Service vulnerability in BEA Systems Weblogic Express and Weblogic Server Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL. network bea-systems | 4.3 |
| 2008-02-22 | CVE-2008-0902 | Cross-Site Scripting vulnerability in multiple products Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. | 4.3 |
| 2008-02-22 | CVE-2008-0901 | Information Exposure vulnerability in multiple products BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not. | 7.1 |
| 2008-02-22 | CVE-2008-0900 | Permissions, Privileges, and Access Controls vulnerability in multiple products Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors. | 6.0 |
| 2008-02-22 | CVE-2008-0896 | Permissions, Privileges, and Access Controls vulnerability in BEA Systems Weblogic Portal 10.0/9.2 BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions. | 4.9 |
| 2008-02-21 | CVE-2008-0870 | Link Following vulnerability in multiple products BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session. | 7.5 |
| 2008-02-21 | CVE-2008-0869 | Cross-Site Scripting vulnerability in multiple products Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows. | 4.3 |