CVE-2007-4616

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/245Patch
http://secunia.com/advisories/26539Patch, Vendor Advisory
http://securitytracker.com/id?1018620Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25472Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3008Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/36320Third Party Advisory, VDB Entry
http://dev2dev.bea.com/pub/advisory/245Patch
http://secunia.com/advisories/26539Patch, Vendor Advisory
http://securitytracker.com/id?1018620Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25472Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3008Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/36320Third Party Advisory, VDB Entry

Timeline

Published: Aug 31, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-46177.8Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attacker CVE-2007-46187.8Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of CVE-2007-46199.3Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow CVE-2007-46209.0Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0 CVE-2007-46217.2Buffer overflow in crontab in IBM AIX 5.2 allows local users to gain privileges via long command line arguments.CVE-2007-46227.2Integer underflow in the dns_name_fromtext function in (1) libdns_nonsecure.a and (2) libdns_secure.a in IBM AIX 5.2 allows local users to g CVE-2007-46237.2Stack-based buffer overflow in the sendrmt function in bellmail in IBM AIX 5.2 and 5.3 allows local users to execute arbitrary code via a lo CVE-2007-46244.3Cross-site scripting (XSS) vulnerability in pframe.php in AbleDesign Dynamic Picture Frame 1.00 allows remote attackers to inject arbitrary CVE-2007-46254.3Polipo before 1.0.2 allows remote HTTP servers to cause a denial of service (daemon crash) by aborting the response to a POST request.CVE-2007-46265.0Unspecified vulnerability in Polipo before 1.0.2 allows remote attackers to cause a denial of service (daemon crash) via certain network tra CVE-2007-46277.5SQL injection vulnerability in index.php in ABC eStore 3.0 allows remote attackers to execute arbitrary SQL commands via the cat_id paramete CVE-2007-46287.5SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.