BEA Systems' vulnerability profile centers on its WebLogic application server and portal products, which sit in the enterprise middleware and request-handling tier of large deployments. The recurring weakness classes—cross-site scripting, sensitive information disclosure, link-following flaws, and memory-safety issues—reflect the complexity of web request processing and server-side templating in a J2EE platform, and the vendor's disclosures tend to acquire public exploit code. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bea Systems over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-3257HIGH Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary | Jul 22, 2008 | 10.0 | 88 | NO | YES |
CVE-2010-2375MEDIUM Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9. | Jul 13, 2010 | 6.4 | 34 | NO | YES |
CVE-2008-0904HIGH Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary | Feb 22, 2008 | 7.8 | 23 | NO | NO |
CVE-2008-0900MEDIUM Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknow | Feb 22, 2008 | 6.0 | 22 | NO | NO |
CVE-2008-0901HIGH BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted | Feb 22, 2008 | 7.1 | 22 | NO | NO |
CVE-2008-0870HIGH BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http | Feb 21, 2008 | 7.5 | 19 | NO | NO |
CVE-2008-0896MEDIUM BEA WebLogic Portal 10.0 and 9.2 through MP1, when an administrator deletes a single instance of a content portlet, removes entitlement policies for other content portlets, which a | Feb 22, 2008 | 4.9 | 16 | NO | NO |
CVE-2008-0902MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspec | Feb 22, 2008 | 4.3 | 16 | NO | NO |
CVE-2008-0903MEDIUM Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause | Feb 22, 2008 | 4.3 | 16 | NO | NO |
CVE-2008-0868MEDIUM Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web scri | Feb 21, 2008 | 4.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bea Systems.
Media articles that mention a CVE ID that affects a product developed by Bea Systems — matched by CVE ID, not by vendor name.