weblogic portal vulnerabilities and fixes

Recent CVEs affecting weblogic portal, with upgrade or downgrade steps. 21 tracked.

Also searched as: weblogicportal.

weblogic portal has 21 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2008-02-22. Highest priority: CVE-2006-0423 (score 49/100).

• CVE-2008-0896 MEDIUM 4.9 DOWNGRADE BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content por
• CVE-2008-0870 HIGH 7.5 DOWNGRADE DOWNGRADE BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user
• CVE-2008-0868 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance
• CVE-2008-0865 MEDIUM 5.0 DOWNGRADE DOWNGRADE Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlement
• CVE-2008-0864 MEDIUM 5.0 DOWNGRADE DOWNGRADE Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an
• CVE-2007-5576 MEDIUM 6.8 DOWNGRADE DOWNGRADE BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password
• CVE-2007-2703 LOW 3.6 DOWNGRADE BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role de
• CVE-2007-2702 LOW 3.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows re
• CVE-2007-0426 MEDIUM 6.8 DOWNGRADE BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitle
• CVE-2007-0423 MEDIUM 4.4 DOWNGRADE BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which
• CVE-2006-1358 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from t
• CVE-2006-0428 HIGH 7.5 DOWNGRADE Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets
• CVE-2006-0425 MEDIUM 5.0 DOWNGRADE BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor f
• CVE-2006-0423 HIGH 7.5 DOWNGRADE BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in
• CVE-2005-1749 MEDIUM 5.0 DOWNGRADE DOWNGRADE Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to caus
• CVE-2005-1748 MEDIUM 5.0 DOWNGRADE DOWNGRADE The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Servic
• CVE-2005-1747 MEDIUM 6.8 DOWNGRADE DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pac
• CVE-2005-1746 MEDIUM 5.0 DOWNGRADE DOWNGRADE The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host
• CVE-2005-1745 MEDIUM 4.6 DOWNGRADE DOWNGRADE The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output
• CVE-2005-1743 HIGH 7.5 DOWNGRADE DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not pr
• CVE-2005-1742 MEDIUM 5.0 DOWNGRADE DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrin

FAQ

How do I fix weblogic portal vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is weblogic portal being exploited right now?

None of the tracked weblogic portal CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which weblogic portal CVE should I patch first?

CVE-2006-0423 currently ranks highest (49/100): BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in .

RSS feed for weblogic portal · ← Back to latest CVEs