Bea Systems

Weblogic Portal

5 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.9

CVE-2008-0896

  • EPSS 0.29%
  • Published 22.02.2008 21:44:00
  • Last modified 09.04.2025 00:30:58

BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended access restrictions.

5

CVE-2008-0864

  • EPSS 0.38%
  • Published 21.02.2008 01:44:00
  • Last modified 09.04.2025 00:30:58

Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove entitlements for pages when an administrator edits the page definition label, which might allow remote attackers to bypass intended access restrictions.

5

CVE-2008-0865

  • EPSS 0.38%
  • Published 21.02.2008 01:44:00
  • Last modified 09.04.2025 00:30:58

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors.

4.3

CVE-2008-0868

  • EPSS 0.32%
  • Published 21.02.2008 01:44:00
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors.

7.5

CVE-2008-0870

  • EPSS 0.29%
  • Published 21.02.2008 01:44:00
  • Last modified 09.04.2025 00:30:58

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.