Vulnerabilities > BEA > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2007-05-16 | CVE-2007-2696 | Remote Security vulnerability in BEA Weblogic Server 6.1/7.0/8.1 The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server. network bea | 6.8 |
| 2007-05-16 | CVE-2007-2695 | Remote Security vulnerability in Weblogic Server The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. | 5.1 |
| 2007-05-16 | CVE-2007-2694 | Cross-Site Scripting vulnerability in Weblogic Server Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. network bea | 4.3 |
| 2007-01-23 | CVE-2007-0434 | Products Multiple vulnerability in BEA Aqualogic Enterprise Security 2.0/2.1/2.2 BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection. | 4.6 |
| 2007-01-23 | CVE-2007-0433 | Products Multiple vulnerability in BEA Aqualogic Service BUS 2.0/2.1/2.2 Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled. | 6.5 |
| 2007-01-23 | CVE-2007-0424 | Products Multiple vulnerability in BEA Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption. | 5.0 |
| 2007-01-23 | CVE-2007-0422 | Products Multiple vulnerability in BEA Weblogic Server 9.0/9.1/9.2 BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections. | 5.0 |
| 2007-01-23 | CVE-2007-0421 | Products Multiple vulnerability in BEA BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log. | 6.4 |
| 2007-01-23 | CVE-2007-0420 | Products Multiple vulnerability in BEA Weblogic Server 9.0/9.1/9.2 BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests. | 5.0 |
| 2007-01-23 | CVE-2007-0419 | Products Multiple vulnerability in BEA The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage). | 5.0 |