Vulnerabilities

TI-2008-00860 CVE-2008-0896 · GHSA-f44m-72vx-4m92

BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single…

LOW 24

BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which allows attackers to bypass intended acces…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.00796 Published 2008-02-22 No fix listed CWE-264

TI-2008-00836 CVE-2008-0870 · GHSA-xh4h-vjm3-wxmv

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances…

LOW 36

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to s…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01431 Published 2008-02-21 No fix listed CWE-59

TI-2008-00834 CVE-2008-0868 · GHSA-v9qm-hc37-6v36

Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and…

LOW 22

Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01074 Published 2008-02-21 No fix listed CWE-79

TI-2008-00831 CVE-2008-0865 · GHSA-rj64-3q6q-qjm9

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers…

LOW 26

Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP6 allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0181 Published 2008-02-21 No fix listed CWE-264

TI-2008-00830 CVE-2008-0864 · GHSA-78g2-xjfj-jhp5

Admin Tools in BEA WebLogic Portal 8.1 SP3 through SP6 can inadvertently remove…