GCVE - cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*

part: a version: 7.0 update: sp7

Vendor	Bea (`c4fe31a7-8f48-5c00-b7c2-e6a20391219c`)
Product	Weblogic Server (`ebf23157-7e5f-5cf4-ba69-dda04749aa52`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-2375`	vulnerable	2026-06-03 14:30:24.996564	Details available Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS. Published: 2010-07-13T22:07:00.000Z Updated: 2024-08-07T02:32:16.381Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3257`	vulnerable	2026-06-03 14:28:52.745047	Details available Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request. Published: 2008-07-22T16:00:00.000Z Updated: 2024-08-07T09:28:41.938Z Open on db.gcve.eu Reference links http://www.attrition.org/pipermail/vim/2008-July/002035.html http://www.attrition.org/pipermail/vim/2008-July/002036.html https://www.exploit-db.com/exploits/6089 http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.html https://support.bea.com/application_content/product_portlets/securityadvisories/2793.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0902`	vulnerable	2026-06-03 14:28:38.353807	Details available Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples. NOTE: this might be the same issue as CVE-2007-2694. Published: 2008-02-22T21:00:00.000Z Updated: 2024-08-07T08:01:40.105Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/273 http://secunia.com/advisories/29041 http://www.vupen.com/english/advisories/2008/0612/references	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0901`	vulnerable	2026-06-03 14:28:38.349736	Details available BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not. Published: 2008-02-22T21:00:00.000Z Updated: 2024-08-07T08:01:40.056Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/271 http://secunia.com/advisories/29041 http://www.vupen.com/english/advisories/2008/0612/references http://www.s21sec.com/avisos/s21sec-040-en.txt http://www.securitytracker.com/id?1019449	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0895`	vulnerable	2026-06-03 14:28:38.330499	Details available BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers. Published: 2008-02-22T21:00:00.000Z Updated: 2024-08-07T08:01:40.067Z Open on db.gcve.eu Reference links http://secunia.com/advisories/29041 http://dev2dev.bea.com/pub/advisory/265 http://www.vupen.com/english/advisories/2008/0612/references http://www.securitytracker.com/id?1019443	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-5576`	vulnerable	2026-06-03 14:28:27.240266	Details available BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands. Published: 2007-10-18T21:00:00.000Z Updated: 2024-08-07T15:39:13.505Z Open on db.gcve.eu Reference links http://osvdb.org/45478 https://exchange.xforce.ibmcloud.com/vulnerabilities/34290 http://dev2dev.bea.com/pub/advisory/226 http://www.vupen.com/english/advisories/2007/1813	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4618`	vulnerable	2026-06-03 14:28:19.015263	Details available Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers. Published: 2007-08-31T00:00:00.000Z Updated: 2024-08-07T15:01:09.818Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26539 http://osvdb.org/38517 http://www.securityfocus.com/bid/22082 http://www.vupen.com/english/advisories/2007/3008 https://exchange.xforce.ibmcloud.com/vulnerabilities/36321	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4617`	vulnerable	2026-06-03 14:28:19.014508	Details available Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors. Published: 2007-08-31T00:00:00.000Z Updated: 2024-08-07T15:01:09.886Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26539 http://www.vupen.com/english/advisories/2007/3008 http://osvdb.org/38518 https://exchange.xforce.ibmcloud.com/vulnerabilities/36319 http://dev2dev.bea.com/pub/advisory/246	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4616`	vulnerable	2026-06-03 14:28:19.010701	Details available The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications. Published: 2007-08-31T00:00:00.000Z Updated: 2024-08-07T15:01:09.759Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26539 https://exchange.xforce.ibmcloud.com/vulnerabilities/36320 http://www.securityfocus.com/bid/25472 http://securitytracker.com/id?1018620 http://www.vupen.com/english/advisories/2007/3008	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4615`	vulnerable	2026-06-03 14:28:19.007457	Details available The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications. Published: 2007-08-31T00:00:00.000Z Updated: 2024-08-07T15:01:09.673Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26539 http://dev2dev.bea.com/pub/advisory/244 http://www.securityfocus.com/bid/25472 http://www.vupen.com/english/advisories/2007/3008 http://securitytracker.com/id?1018619	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4613`	vulnerable	2026-06-03 14:28:19.001018	Details available SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461. Published: 2007-08-31T00:00:00.000Z Updated: 2024-08-07T15:01:09.933Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/22082 http://dev2dev.bea.com/pub/advisory/201 http://osvdb.org/45838	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2701`	vulnerable	2026-06-03 14:28:09.196281	Details available The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue." Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.405Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/234 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 https://exchange.xforce.ibmcloud.com/vulnerabilities/34287 http://www.vupen.com/english/advisories/2007/1815	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2695`	vulnerable	2026-06-03 14:28:09.181812	Details available The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.548Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/274 https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 http://securitytracker.com/id?1018057 http://secunia.com/advisories/25284 http://secunia.com/advisories/29041	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-2694`	vulnerable	2026-06-03 14:28:09.171095	Details available Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2007-05-16T01:00:00.000Z Updated: 2024-08-07T13:49:57.192Z Open on db.gcve.eu Reference links http://osvdb.org/36075 http://secunia.com/advisories/25284 http://dev2dev.bea.com/pub/advisory/232 http://www.vupen.com/english/advisories/2007/1815	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-0421`	vulnerable	2026-06-03 14:27:56.685484	Details available BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log. Published: 2007-01-23T00:00:00.000Z Updated: 2024-08-07T12:19:29.921Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1017525 http://secunia.com/advisories/23750 http://www.securityfocus.com/bid/22082 http://osvdb.org/32859 http://dev2dev.bea.com/pub/advisory/215	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-0412`	vulnerable	2026-06-03 14:27:56.676763	Details available BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files. Published: 2007-01-23T00:00:00.000Z Updated: 2024-08-07T12:19:30.163Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1017525 http://secunia.com/advisories/23750 http://www.securityfocus.com/bid/22082 http://dev2dev.bea.com/pub/advisory/206 http://osvdb.org/38505	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4764`	vulnerable	2026-06-03 14:27:14.235649	Details available BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins). Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-17T03:43:22.570Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/155 http://www.securityfocus.com/bid/15052 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4763`	vulnerable	2026-06-03 14:27:14.234072	Details available BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions. Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-16T16:53:44.302Z Open on db.gcve.eu Reference links http://dev2dev.bea.com/pub/advisory/154 http://www.securityfocus.com/bid/15052 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4750`	vulnerable	2026-06-03 14:27:14.211562	Details available BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. Published: 2006-04-01T02:00:00.000Z Updated: 2024-09-16T22:36:34.769Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/15052 http://dev2dev.bea.com/pub/advisory/138 http://secunia.com/advisories/17138	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.