GCVE - cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bea:weblogic_server:9.0:*:express:*:*:*:*:*

part: a version: 9.0 update: *

Vendor	Bea (`c4fe31a7-8f48-5c00-b7c2-e6a20391219c`)
Product	Weblogic Server (`ebf23157-7e5f-5cf4-ba69-dda04749aa52`)
Edition	express
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-0863`	vulnerable	2026-06-03 14:28:38.226012	Details available BEA WebLogic Server and WebLogic Express 9.0 and 9.1 exposes the web service's WSDL and security policies, which allows remote attackers to obtain sensitive information and potentially launch further attacks. Published: 2008-02-21T01:00:00.000Z Updated: 2024-08-07T08:01:40.101Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id?1019455 http://www.vupen.com/english/advisories/2008/0612/references http://dev2dev.bea.com/pub/advisory/260	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2700`	vulnerable	2026-06-03 14:28:09.195731	Details available The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.180Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/233 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 https://exchange.xforce.ibmcloud.com/vulnerabilities/34288 http://osvdb.org/36068	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2699`	vulnerable	2026-06-03 14:28:09.195365	Details available The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.306Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/231 http://osvdb.org/36069 https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2697`	vulnerable	2026-06-03 14:28:09.189377	Details available The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.266Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/229 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 http://www.vupen.com/english/advisories/2007/1815 http://osvdb.org/36072	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2695`	vulnerable	2026-06-03 14:28:09.187032	Details available The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.548Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/274 https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 http://secunia.com/advisories/29041	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0432`	vulnerable	2026-06-03 14:27:21.020080	Details available Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources. Published: 2006-01-25T23:00:00.000Z Updated: 2024-08-07T16:34:14.806Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2006/0313 https://exchange.xforce.ibmcloud.com/vulnerabilities/24299 http://securitytracker.com/id?1015528 http://secunia.com/advisories/18592 http://dev2dev.bea.com/pub/advisory/176	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0429`	vulnerable	2026-06-03 14:27:21.018519	Details available BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions. Published: 2006-01-25T23:00:00.000Z Updated: 2024-08-07T16:34:14.827Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2006/0313 http://www.osvdb.org/22773 https://exchange.xforce.ibmcloud.com/vulnerabilities/24298 http://securitytracker.com/id?1015528 http://secunia.com/advisories/18592	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0419`	vulnerable	2026-06-03 14:27:20.983616	Details available BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections. Published: 2006-01-25T23:00:00.000Z Updated: 2024-08-07T16:34:14.652Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1015528 http://dev2dev.bea.com/pub/advisory/163	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4751`	vulnerable	2026-06-03 14:27:14.225116	Details available Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors. Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-17T02:47:24.793Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/139 http://www.securityfocus.com/bid/15052 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.