CVE-2003-1094

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp
http://www.kb.cert.org/vuls/id/999788Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/8320Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/12799
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp
http://www.kb.cert.org/vuls/id/999788Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/8320Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/12799

Timeline

Published: Dec 31, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-10954.6BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication CVE-2003-109610.0The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it CVE-2003-10977.2Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l op CVE-2003-10987.2The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges.CVE-2003-10992.1shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a deni CVE-2003-11004.3Multiple cross-site scripting (XSS) vulnerabilities in Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allow remote attackers to inject arbitrary CVE-2003-11015.0Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allows remote attackers to obtain the full path of the DM Web Server via invalid login credentials CVE-2003-11025.0Hummingbird CyberDOCS 3.5, 3.9, and 4.0, when running on IIS, uses insecure permissions for script source code files, which allows remote at CVE-2003-11037.5SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before 3.9 allows remote attackers to execute arbitrary SQL commands.CVE-2003-110410.0Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) 1.2 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2003-11052.6Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook CVE-2003-11065.0The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail mes