BE
Vendor
Bea
171
CVEs
0
On KEV
0
New 30D
Products
WS9.8
Weblogic Server
Bea
150 CVEs0 on KEV0 new
TU–
Tuxedo
Bea
5 CVEs0 on KEV0 new
WI–
Weblogic Integration
Bea
4 CVEs0 on KEV0 new
WW–
Weblogic Workshop
Bea
4 CVEs0 on KEV0 new
AI–
Aqualogic Interaction
Bea
2 CVEs0 on KEV0 new
AS–
Aqualogic Service Bus
Bea
2 CVEs0 on KEV0 new
AE–
Aqualogic Enterprise Security
Bea
1 CVEs0 on KEV0 new
JR–
Jrockit
Bea
1 CVEs0 on KEV0 new
LD–
Liquid Data
Bea
1 CVEs0 on KEV0 new
WM–
Weblogic Mobility Server
Bea
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-21175 | WS Weblogic Server Bea | 9.1 | Jul 16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) |
| CVE-2010-2375 | WS Weblogic Server Bea | – | Jul 13 | Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1,… |
| CVE-2008-3257 | WS Weblogic Server Bea | – | Jul 22 | Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary… |
| CVE-2008-0902 | WS Weblogic Server Bea | – | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via… |
| CVE-2008-0898 | WS Weblogic Server Bea | – | Feb 22 | The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does not properly handle when a client cannot send a message to a member… |
| CVE-2008-0901 | WS Weblogic Server Bea | – | Feb 22 | BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via… |
| CVE-2008-0900 | WS Weblogic Server Bea | – | Feb 22 | Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via… |
| CVE-2008-0897 | WS Weblogic Server Bea | – | Feb 22 | Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and… |
| CVE-2008-0895 | WS Weblogic Server Bea | – | Feb 22 | BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers |
| CVE-2008-0899 | WS Weblogic Server Bea | – | Feb 22 | Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script… |
| CVE-2008-0863 | WS Weblogic Server Bea | – | Feb 21 | BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and… |
| CVE-2008-0866 | WW Weblogic Workshop Bea | – | Feb 21 | Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject arbitrary web script or HTML via an invalid action URI, which is not… |
| CVE-2008-0869 | WS Weblogic Server Bea | – | Feb 21 | Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script… |
| CVE-2007-6384 | WM Weblogic Mobility Server Bea | – | Dec 15 | Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file… |
| CVE-2007-6197 | AI Aqualogic Interaction Bea | – | Dec 1 | The Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows remote attackers to obtain version numbers and internal hostnames by reading comments… |
| CVE-2007-6198 | AI Aqualogic Interaction Bea | – | Dec 1 | portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote… |
| CVE-2007-5576 | WW Weblogic Workshop Bea | – | Oct 18 | BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain… |
| CVE-2007-4615 | WS Weblogic Server Bea | – | Aug 31 | The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are… |
| CVE-2007-4616 | WS Weblogic Server Bea | – | Aug 31 | The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no… |
| CVE-2007-4613 | WS Weblogic Server Bea | – | Aug 31 | SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a… |
| CVE-2007-4614 | WS Weblogic Server Bea | – | Aug 31 | BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow… |
| CVE-2007-4618 | WS Weblogic Server Bea | – | Aug 31 | Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain… |
| CVE-2007-4617 | WS Weblogic Server Bea | – | Aug 31 | Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server… |
| CVE-2007-2704 | WS Weblogic Server Bea | – | May 16 | BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket |
| CVE-2007-2698 | WS Weblogic Server Bea | – | May 16 | The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive… |
| CVE-2007-2699 | WS Weblogic Server Bea | – | May 16 | The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative… |
| CVE-2007-2697 | WS Weblogic Server Bea | – | May 16 | The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed… |
| CVE-2007-2695 | WS Weblogic Server Bea | – | May 16 | The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is… |
| CVE-2007-2696 | WS Weblogic Server Bea | – | May 16 | The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to… |
| CVE-2007-2694 | WS Weblogic Server Bea | – | May 16 | Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote… |
| CVE-2007-2700 | WS Weblogic Server Bea | – | May 16 | The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when… |
| CVE-2007-2705 | WI Weblogic Integration Bea | – | May 16 | Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded… |
| CVE-2007-2701 | WS Weblogic Server Bea | – | May 16 | The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not… |
| CVE-2007-0432 | AS Aqualogic Service Bus Bea | – | Jan 23 | BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization… |
| CVE-2007-0433 | AS Aqualogic Service Bus Bea | – | Jan 23 | Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows… |
| CVE-2007-0434 | AE Aqualogic Enterprise Security Bea | – | Jan 23 | BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which… |
| CVE-2007-0418 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters,… |
| CVE-2007-0416 | WS Weblogic Server Bea | – | Jan 23 | The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass… |
| CVE-2007-0419 | WS Weblogic Server Bea | – | Jan 23 | The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of… |
| CVE-2007-0417 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB… |
| CVE-2007-0412 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or… |
| CVE-2007-0413 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading… |
| CVE-2007-0410 | WS Weblogic Server Bea | – | Jan 23 | Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers… |
| CVE-2007-0420 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests |
| CVE-2007-0408 | WS Weblogic Server Bea | – | Jan 23 | BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an… |
| CVE-2007-0409 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local… |
| CVE-2007-0414 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests… |
| CVE-2007-0415 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through… |
| CVE-2007-0425 | JR Jrockit Bea | – | Jan 23 | Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors,… |
| CVE-2007-0421 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers,… |
| CVE-2007-0422 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket… |
| CVE-2007-0424 | WS Weblogic Server Bea | – | Jan 23 | Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to… |
| CVE-2007-0411 | WS Weblogic Server Bea | – | Jan 23 | BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a… |
| CVE-2006-2546 | WS Weblogic Server Bea | – | May 23 | A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the… |
| CVE-2006-2469 | WS Weblogic Server Bea | – | May 19 | The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access… |
| CVE-2006-2470 | WS Weblogic Server Bea | – | May 19 | Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly,… |
| CVE-2006-2471 | WS Weblogic Server Bea | – | May 19 | Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP… |
| CVE-2006-2468 | WS Weblogic Server Bea | – | May 19 | The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers… |
| CVE-2006-2464 | WS Weblogic Server Bea | – | May 19 | stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local… |
| CVE-2006-2466 | WS Weblogic Server Bea | – | May 19 | BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a… |