GCVE - cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bea:weblogic_server:7.0:sp7:express:*:*:*:*:*

part: a version: 7.0 update: sp7

Vendor	Bea (`c4fe31a7-8f48-5c00-b7c2-e6a20391219c`)
Product	Weblogic Server (`ebf23157-7e5f-5cf4-ba69-dda04749aa52`)
Edition	express
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2007-5576`	vulnerable	2026-06-03 14:28:27.240770	Details available BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands. Published: 2007-10-18T21:00:00.000Z Updated: 2024-08-07T15:39:13.505Z Open on db.gcve.eu Reference links http://osvdb.org/45478 https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 http://dev2dev.bea.com/pub/advisory/226 http://www.vupen.com/english/advisories/2007/1813	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2697`	vulnerable	2026-06-03 14:28:09.189141	Details available The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.266Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/229 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 http://www.vupen.com/english/advisories/2007/1815 http://osvdb.org/36072	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2695`	vulnerable	2026-06-03 14:28:09.181829	Details available The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.548Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/274 https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 http://secunia.com/advisories/29041	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2694`	vulnerable	2026-06-03 14:28:09.171597	Details available Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.192Z Open on db.gcve.eu Reference links http://osvdb.org/36075 http://secunia.com/advisories/25284 http://dev2dev.bea.com/pub/advisory/232 http://www.vupen.com/english/advisories/2007/1815	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4764`	vulnerable	2026-06-03 14:27:14.235666	Details available BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins). Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-17T03:43:22.570Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/155 http://www.securityfocus.com/bid/15052 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4750`	vulnerable	2026-06-03 14:27:14.212267	Details available BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-16T22:36:34.769Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/15052 http://dev2dev.bea.com/pub/advisory/138 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.