bea vulnerabilities

Recent CVEs affecting bea products. 158 tracked.

bea has 158 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 16. Most recent: 2010-07-13. Highest priority: CVE-2008-3257 (score 70/100).

• CVE-2000-1238 HIGH 7.5 DOWNGRADE BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls
• CVE-2010-2375 MEDIUM 6.4 DOWNGRADE DOWNGRADE Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Serve
• CVE-2008-3257 HIGH 10.0 DOWNGRADE MITIGATE Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic
• CVE-2008-0902 MEDIUM 4.3 DOWNGRADE DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 al
• CVE-2008-0901 HIGH 7.1 DOWNGRADE DOWNGRADE BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guess
• CVE-2008-0900 MEDIUM 6.0 DOWNGRADE DOWNGRADE Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10
• CVE-2008-0899 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0
• CVE-2008-0898 MEDIUM 5.8 DOWNGRADE The distributed queue feature in JMS in BEA WebLogic Server 9.0 through 10.0, in certain configurations, does
• CVE-2008-0897 HIGH 7.9 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "r
• CVE-2008-0895 MEDIUM 6.4 DOWNGRADE BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for
• CVE-2008-0869 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.
• CVE-2008-0866 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Workshop allow remote attackers to inject
• CVE-2008-0863 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, whi
• CVE-2007-6384 HIGH 7.5 DOWNGRADE Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3
• CVE-2007-6198 MEDIUM 5.0 DOWNGRADE portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allo
• CVE-2007-6197 MEDIUM 5.0 DOWNGRADE The Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows remote attackers
• CVE-2007-5576 MEDIUM 6.8 DOWNGRADE DOWNGRADE BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password
• CVE-2007-4618 HIGH 7.8 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote a
• CVE-2007-4617 HIGH 7.8 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold thro
• CVE-2007-4616 MEDIUM 6.4 DOWNGRADE The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2
• CVE-2007-4615 MEDIUM 6.4 UPGRADE The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through
• CVE-2007-4614 HIGH 7.5 DOWNGRADE BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log t
• CVE-2007-4613 MEDIUM 6.8 DOWNGRADE SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 migh
• CVE-2007-2705 HIGH 7.8 DOWNGRADE DOWNGRADE Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebL
• CVE-2007-2704 MEDIUM 5.4 DOWNGRADE BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailabil
• CVE-2007-2701 MEDIUM 4.6 DOWNGRADE The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured
• CVE-2007-2700 MEDIUM 4.0 DOWNGRADE The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.
• CVE-2007-2699 HIGH 7.1 DOWNGRADE The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce c
• CVE-2007-2698 MEDIUM 5.0 DOWNGRADE The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configu
• CVE-2007-2697 MEDIUM 5.1 DOWNGRADE The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, an
• CVE-2007-2696 MEDIUM 6.8 DOWNGRADE The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security
• CVE-2007-2695 MEDIUM 5.1 DOWNGRADE The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 t
• CVE-2007-2694 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP
• CVE-2007-0434 MEDIUM 4.6 DOWNGRADE BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the
• CVE-2007-0433 MEDIUM 6.5 DOWNGRADE Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2
• CVE-2007-0432 HIGH 7.5 DOWNGRADE BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy ser
• CVE-2007-0425 HIGH 7.5 UPGRADE UPGRADE Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and
• CVE-2007-0424 MEDIUM 5.0 MITIGATE Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before Septe
• CVE-2007-0422 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a deni
• CVE-2007-0421 MEDIUM 6.4 DOWNGRADE BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of
• CVE-2007-0420 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malform
• CVE-2007-0419 MEDIUM 5.0 MITIGATE The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle pro
• CVE-2007-0418 HIGH 7.5 UPGRADE BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy
• CVE-2007-0417 HIGH 10.0 UPGRADE BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1
• CVE-2007-0416 HIGH 7.5 DOWNGRADE The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when dec
• CVE-2007-0415 MEDIUM 5.0 UPGRADE BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dy
• CVE-2007-0414 MEDIUM 5.0 UPGRADE BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attac
• CVE-2007-0413 MEDIUM 4.4 UPGRADE BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing,
• CVE-2007-0412 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers
• CVE-2007-0411 MEDIUM 6.8 UPGRADE BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly v
• CVE-2007-0410 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9
• CVE-2007-0409 LOW 1.5 UPGRADE BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stor
• CVE-2007-0408 HIGH 7.5 UPGRADE BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached con
• CVE-2006-2546 MEDIUM 5.0 DOWNGRADE A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 200
• CVE-2006-2472 MEDIUM 4.9 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 throug
• CVE-2006-2471 MEDIUM 5.0 DOWNGRADE Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sen
• CVE-2006-2470 HIGH 7.5 DOWNGRADE Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents t
• CVE-2006-2469 HIGH 7.5 DOWNGRADE The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the usern
• CVE-2006-2468 MEDIUM 4.0 DOWNGRADE The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the
• CVE-2006-2467 MEDIUM 4.0 DOWNGRADE BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the We
• CVE-2006-2466 LOW 2.6 DOWNGRADE BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP p
• CVE-2006-2464 MEDIUM 4.6 DOWNGRADE stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the ad
• CVE-2006-2462 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-
• CVE-2006-2461 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumst
• CVE-2006-1352 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7
• CVE-2006-1351 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vec
• CVE-2006-0432 LOW 2.1 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebL
• CVE-2006-0431 LOW 2.1 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to
• CVE-2006-0430 MEDIUM 5.0 DOWNGRADE Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6,
• CVE-2006-0429 LOW 2.1 DOWNGRADE BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have
• CVE-2006-0427 LOW 2.1 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious
• CVE-2006-0426 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a passwor
• CVE-2006-0424 MEDIUM 4.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote a
• CVE-2006-0422 MEDIUM 6.4 DOWNGRADE Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through
• CVE-2006-0421 MEDIUM 4.6 DOWNGRADE By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same
• CVE-2006-0420 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when ser
• CVE-2006-0419 MEDIUM 6.4 DOWNGRADE BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to t
• CVE-2005-4767 MEDIUM 5.1 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/pas
• CVE-2005-4766 MEDIUM 5.4 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicas
• CVE-2005-4765 HIGH 7.6 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.
• CVE-2005-4764 HIGH 7.8 DOWNGRADE BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple inco
• CVE-2005-4763 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, wh
• CVE-2005-4762 HIGH 7.2 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier som
• CVE-2005-4761 LOW 1.2 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log
• CVE-2005-4760 MEDIUM 5.1 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuth
• CVE-2005-4759 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do
• CVE-2005-4758 MEDIUM 4.0 DOWNGRADE Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and
• CVE-2005-4757 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constr
• CVE-2005-4756 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validat
• CVE-2005-4755 LOW 2.1 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrus
• CVE-2005-4754 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive inform
• CVE-2005-4753 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage
• CVE-2005-4752 MEDIUM 4.6 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users
• CVE-2005-4751 MEDIUM 6.8 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 a
• CVE-2005-4750 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier all
• CVE-2005-4749 MEDIUM 5.0 DOWNGRADE HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6
• CVE-2005-4705 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java cl
• CVE-2005-4704 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.
• CVE-2005-2092 MEDIUM 4.3 DOWNGRADE BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall
• CVE-2005-1749 MEDIUM 5.0 DOWNGRADE DOWNGRADE Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to caus
• CVE-2005-1748 MEDIUM 5.0 DOWNGRADE DOWNGRADE The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Servic
• CVE-2005-1747 MEDIUM 6.8 DOWNGRADE DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pac
• CVE-2005-1746 MEDIUM 5.0 DOWNGRADE DOWNGRADE The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host
• CVE-2005-1745 MEDIUM 4.6 DOWNGRADE DOWNGRADE The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output
• CVE-2005-1744 CRITICAL 9.8 UPGRADE BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application
• CVE-2005-1743 HIGH 7.5 DOWNGRADE DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not pr
• CVE-2005-1742 MEDIUM 5.0 DOWNGRADE DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrin
• CVE-2005-1380 MEDIUM 6.8 DOWNGRADE Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary
• CVE-2005-0432 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different lo
• CVE-2004-2696 MEDIUM 5.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Int
• CVE-2004-2424 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of servi
• CVE-2004-2321 LOW 2.1 DOWNGRADE BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administ
• CVE-2004-2320 MEDIUM 5.3 DOWNGRADE The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 thr
• CVE-2004-1758 MEDIUM 4.6 DOWNGRADE BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the
• CVE-2004-1757 MEDIUM 4.6 DOWNGRADE BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config
• CVE-2004-1756 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL wi
• CVE-2004-0715 MEDIUM 5.1 DOWNGRADE The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 thro
• CVE-2004-0713 MEDIUM 6.4 DOWNGRADE The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version
• CVE-2004-0712 MEDIUM 4.6 DOWNGRADE The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through
• CVE-2004-0711 HIGH 7.5 DOWNGRADE The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcard
• CVE-2004-0652 HIGH 7.2 DOWNGRADE BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, a
• CVE-2004-0471 LOW 2.1 DOWNGRADE BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restriction
• CVE-2004-0470 HIGH 7.5 DOWNGRADE BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using
• CVE-2004-0204 HIGH 7.5 DOWNGRADE MITIGATE Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crysta
• CVE-2003-1438 MEDIUM 4.3 DOWNGRADE Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replicatio
• CVE-2003-1437 LOW 2.1 DOWNGRADE BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is use
• CVE-2003-1290 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allow
• CVE-2003-1226 LOW 2.1 DOWNGRADE BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecure
• CVE-2003-1225 LOW 2.1 DOWNGRADE The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext
• CVE-2003-1224 LOW 2.1 DOWNGRADE Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean
• CVE-2003-1223 MEDIUM 5.0 DOWNGRADE The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a d
• CVE-2003-1222 MEDIUM 5.0 DOWNGRADE BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider
• CVE-2003-1221 MEDIUM 5.0 DOWNGRADE BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 ove
• CVE-2003-1220 MEDIUM 5.0 DOWNGRADE BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attack
• CVE-2003-1095 MEDIUM 4.6 DOWNGRADE BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications,
• CVE-2003-1094 HIGH 7.2 DOWNGRADE BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an inco
• CVE-2003-1093 MEDIUM 4.6 DOWNGRADE BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, m
• CVE-2003-0733 MEDIUM 6.8 DOWNGRADE DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in WebLogic Integration 7.0 and 2.0, Liquid Data 1.1, and
• CVE-2003-0640 HIGH 10.0 MITIGATE BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privile
• CVE-2003-0624 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remot
• CVE-2003-0623 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows r
• CVE-2003-0622 MEDIUM 5.0 DOWNGRADE DOWNGRADE The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service
• CVE-2003-0621 MEDIUM 5.0 DOWNGRADE DOWNGRADE The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence o
• CVE-2003-0151 HIGH 7.5 DOWNGRADE BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets
• CVE-2002-2177 LOW 2.6 DOWNGRADE BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send
• CVE-2002-2142 HIGH 7.5 DOWNGRADE DOWNGRADE An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogi
• CVE-2002-2141 HIGH 7.5 DOWNGRADE BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more
• CVE-2002-1030 LOW 2.6 DOWNGRADE Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remot
• CVE-2002-0106 MEDIUM 5.0 DOWNGRADE BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests
• CVE-2001-1477 MEDIUM 4.6 DOWNGRADE The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces o

FAQ

How do I fix bea vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is bea being exploited right now?

None of the tracked bea CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which bea CVE should I patch first?

CVE-2008-3257 currently ranks highest (70/100): Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic .

Products

• aqualogic enterprise security
• aqualogic interaction
• aqualogic service bus
• jrockit
• liquid data
• tuxedo
• weblogic integration
• weblogic mobility server
• weblogic server
• weblogic workshop

RSS feed for bea · ← Back to latest CVEs