10527 matches found
CVE-2005-4764
CVE-2005-4764 affects BEA WebLogic Server and WebLogic Express versions 9.0, 8.1, and 7.0. The issue causes the admin user account to be locked out after multiple incorrect password guesses, enabling remote attackers who know or guess the admin username to cause a denial of service via blocked ad...
CVE-2005-4762
CVE-2005-4762 affects BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The boot password is stored in the registry in cleartext, which might allow local users to gain administrative privileges. Connected sources corroborate the a...
CVE-2005-4761
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information passwords or keyphrases in the server log file when the -D option is used...
CVE-2005-4762
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges...
CVE-2005-4759
CVE-2005-4759 affects BEA WebLogic Server and WebLogic Express 8.1 and 7.0. During OS platform migrations, it does not warn the admin about URLResource case-sensitivity differences, which may cause local users to inadvertently lose protection of Web Application pages. The NVD metrics show a base ...
CVE-2005-4749
CVE-2005-4749 describes an HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express. Affected products include WebLogic Server/Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The flaw allows remote attackers to inject arbitrary HTTP headers via u...
CVE-2005-4752
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, are affected by CVE-2005-4752. The vulnerability allows local users to elevate privileges by abusing the run-as deployment descriptor element to change a web application or EJB from the Deployer security role t...
CVE-2005-4756
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, are described as vulnerable due to improper validation of derived Principals when multiple PrincipalValidators are involved, potentially allowing privilege escalation. The Connected documents reiterate the affe...
CVE-2005-4754
CVE-2005-4754 affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier. The issue allows remote attackers to obtain sensitive information (intranet IP addresses) through unspecified attack vectors related to network address translation. The connected sources confirm the affected produ...
CVE-2005-4761
BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which may include passwords or keyphrases in the server log when the -D option is used. Affected products/versions are described in mult...
CVE-2005-4751
CVE-2005-4751 describes multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express. Affected versions include WebLogic Server/Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. Attackers could inject arbitrary web script or HTML an...
CVE-2005-4767
CVE-2005-4767 affects BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier. The issue is that, when using username/password authentication, the server does not lock out a username after the maximum number of invalid login attempts, enabling easier guessing of pass...
CVE-2005-4750
CVE-2005-4750 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier. It allows remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. The provided documents do not include concrete exploit details...
CVE-2005-4760
The CVE affects BEA WebLogic Server and WebLogic Express: versions 8.1 SP3 and earlier, and 7.0 SP5 and earlier, where fullyDelegatedAuthorization is enabled for a servlet. The issue is that if authorization or the role providers fail, servlet deployment may not fail as intended, potentially leav...
CVE-2005-4763
CVE-2005-4763 affects BEA WebLogic Server and WebLogic Express (8.1 SP4 and earlier; 7.0 SP6 and earlier; 6.1 SP7 and earlier) where IIOP usage can leak a password in an exception message or logged output, potentially enabling remote attackers to perform unauthorized actions. The vulnerability is...
RealPlayer invalid chunk header heap overflow
Added: 03/31/2006 CVE: CVE-2005-2922 BID: 17202 OSVDB: 24062 Background RealPlayer, RealOne Player, and Helix Player include an embedded player which plays media embedded in a web page. Problem A chunked HTTP response containing an invalid or missing chunk header results in a heap overflow, leadi...
RealPlayer invalid chunk header heap overflow
Added: 03/31/2006 CVE: CVE-2005-2922 BID: 17202 OSVDB: 24062 Background RealPlayer, RealOne Player, and Helix Player include an embedded player which plays media embedded in a web page. Problem A chunked HTTP response containing an invalid or missing chunk header results in a heap overflow, leadi...
RealPlayer invalid chunk header heap overflow
Added: 03/31/2006 CVE: CVE-2005-2922 BID: 17202 OSVDB: 24062 Background RealPlayer, RealOne Player, and Helix Player include an embedded player which plays media embedded in a web page. Problem A chunked HTTP response containing an invalid or missing chunk header results in a heap overflow, leadi...
CVE-2005-4748
Technical details about CVE-2005-4748 are not publicly provided in the supplied documents; no concrete vulnerabilities, affected versions, or fixes are described. Monitor for updates.
