Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.

According to its banner, the remote host is running a version of BEA WebLogic Server or WebLogic Express that is prone to multiple vulnerabilities.  These flaws could lead to buffer overflows, denial of service, unauthorized access, cross-site scripting attacks, and information disclosure.

The remote host is running a version of BEA WebLogic Server or WebLogic Express that is prone to multiple vulnerabilities.  These flaws could lead to buffer overflows, denial of service, unauthorized access, cross-site scripting attacks, and information disclosure. 

The remote host is running BEA WebLogic. This version of WebLogic is vulnerable to an information disclosure flaw.  Specifically, failed logins yield information regarding authentication scheme, validity of user ID, and more. 

ID	Name	Product	Family	Severity
18365	BEA WebLogic <= 8.1 SP4 Multiple Vulnerabilities (XSS, DoS, ID, more)	Nessus	Web Servers	high
2862	BEA WebLogic < 8.1 SP5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
2615	BEA WebLogic < 8.1.0 SP4 Information Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2005-1380

medium

Tenable Plugins

high

medium

medium