Bea Systems

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2010-2375 3Bea Bea SystemsOracle 3Weblogic Server Weblogic ServerWeblogic Server Apr 29, 2026 Jul 13, 2010 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allo...Show more Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.Show less
CVE-2008-3257 3Bea Bea SystemsOracle 4Apache Connector In Weblogic Server Weblogic ServerWeblogic Server+1 more Apr 23, 2026 Jul 22, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as...Show more Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.Show less
CVE-2008-0904 1Bea Systems 2Aqualogic Interaction Plumtree Collaboration Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 7.8 HIGH· v2 Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary files via a crafted URL.
CVE-2008-0903 1Bea Systems 2Weblogic Express Weblogic Server Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash)...Show more Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL.Show less
CVE-2008-0902 2Bea Bea Systems 2Weblogic Server Weblogic Server Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the...Show more Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694.Show less
CVE-2008-0901 2Bea Bea Systems 2Weblogic Server Weblogic Server Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 7.1 HIGH· v2 BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed pa...Show more BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.Show less
CVE-2008-0900 2Bea Bea Systems 2Weblogic Express Weblogic Server Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 6.0 MEDIUM· v2 Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
CVE-2008-0896 1Bea Systems 1Weblogic Portal Apr 23, 2026 Feb 22, 2008 N/A· v4 N/A· v3 4.9 MEDIUM· v2 BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended acces...Show more BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions.Show less
CVE-2008-0870 2Bea Systems Oracle 2Weblogic Portal Weblogic Portal Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to s...Show more BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.Show less
CVE-2008-0869 2Bea Bea Systems 3Weblogic Weblogic ServerWeblogic Workshop Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request...Show more Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.Show less
CVE-2008-0868 2Bea Systems Oracle 2Weblogic Portal Weblogic Portal Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors.
CVE-2008-0867 1Bea Systems 2Aqualogic Interaction Plumtree Foundation Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in portal/server.pt in BEA AquaLogic Interaction 6.1 through MP1 and Plumtree Foundation 6.0 through SP1 allows remote attackers to inject arbitrary web script or HTML via the nam...Show more Cross-site scripting (XSS) vulnerability in portal/server.pt in BEA AquaLogic Interaction 6.1 through MP1 and Plumtree Foundation 6.0 through SP1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.Show less
CVE-2008-0865 2Bea Systems Oracle 2Weblogic Portal Weblogic Portal Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors.
CVE-2008-0864 2Bea Systems Oracle 2Weblogic Portal Weblogic Portal Apr 23, 2026 Feb 21, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access r...Show more Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.Show less