Vulnerabilities > BEA
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-02-21 | CVE-2008-0866 | Cross-Site Scripting vulnerability in BEA Weblogic Workshop 8.1 Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject arbitrary web script or HTML via an invalid action URI, which is not properly handled by NetUI page flows. | 4.3 |
| 2008-02-21 | CVE-2008-0863 | Information Exposure vulnerability in BEA Weblogic Server 9.0/9.1 BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks. | 5.0 |
| 2007-12-15 | CVE-2007-6384 | Improper Authentication vulnerability in BEA Weblogic Mobility Server 3.3/3.5/3.6 Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors. | 7.5 |
| 2007-12-01 | CVE-2007-6198 | Information Disclosure vulnerability in BEA AquaLogic Interaction Plumtree Portal portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote attackers to enumerate valid usernames via the in_tx_fulltext parameter. | 5.0 |
| 2007-12-01 | CVE-2007-6197 | Information Exposure vulnerability in BEA Aqualogic Interaction The Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows remote attackers to obtain version numbers and internal hostnames by reading comments in the HTML source of any page. | 5.0 |
| 2007-10-18 | CVE-2007-5576 | Information Exposure vulnerability in multiple products BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands. | 6.8 |
| 2007-08-31 | CVE-2007-4618 | Resource Management Errors vulnerability in BEA Weblogic Server 6.0/6.1/7.0 Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers. | 7.8 |
| 2007-08-31 | CVE-2007-4617 | Resource Management Errors vulnerability in BEA Weblogic Server Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors. | 7.8 |
| 2007-08-31 | CVE-2007-4616 | Information Disclosure vulnerability in BEA WebLogic Server Null Cipher Suite The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications. | 6.4 |
| 2007-08-31 | CVE-2007-4615 | Information Disclosure vulnerability in BEA WebLogic Server Null Cipher Suite The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications. | 6.4 |