CVE-2006-2471

Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including 1 DNS and IP addresses to address to T3 clients, 2 internal sensitive information using GetIORServlet, 3 certain "server details" in...

CVE-2006-2464

CVE-2006-2464 affects BEA WebLogic Server 8.1 (<SP4) and 7.0 (

CVE-2006-2462

BEA WebLogic Server 8.1 (before Service Pack 4) and 7.0 (before Service Pack 6) is affected. The vulnerability arises when using JTA transactions, where sensitive data may be sent over non-secure channels, allowing remote read access to potentially sensitive network traffic. The provided sources ...

CVE-2006-2472

BEA WebLogic Server versions affected: 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7. The CVE-2006-2472 entry describes an unspecified vulnerability that allows untrusted applications to obtain private server keys. The connected documents corroborate the affected product and ...

CVE-2006-2461

BEA WebLogic Server prior to 8.1 SP4 has a QoS handling flaw that can prevent SSL-encrypted transmissions, risking exposure of sensitive network traffic. The available documents state the issue and affected version, but do not provide explicit exploit details or a remediation path; no additional ...

CVE-2006-2467

CVE-2006-2467 affects BEA WebLogic Server: WebLogic Server Administration Console can disclose the server’s internal IP address. Vulnerable versions are 6.1 up to SP7, 7.0 up to SP6, and 8.1 up to SP4. Root cause is exposure of internal IP in the Console; impact is information disclosure of inter...

CVE-2006-2466

BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."...

CVE-2006-2462

BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic...

CVE-2006-2468

Vulnerability details for CVE-2006-2468 show that BEA WebLogic Server Administration Console exposes the domain name in the login form for BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6. The underlying issue is information disclosure in the Console login interface, which can allow remote att...

CVE-2006-2466

BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 are affected by the JSP showcode vulnerability. Under certain timing-window conditions during a JSP compilation error, remote attackers can obtain the JSP source code, exposing partial confidentiality. The available documents do not specify a re...

CVE-2006-2464

stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display...

BEA WebLogic Server Multiple Vulnerabilities

Binary data 3618.prm...

CVE-2005-4753

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection...

CVE-2005-4759

BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages...

CVE-2005-4767

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password...

CVE-2005-4766

CVE-2005-4766 affects BEA WebLogic Server and WebLogic Express; versions 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic. The root cause is lack of encryption for multicast communications, which could allow an attacker to read sensitive cluster synchronization messa...

CVE-2005-4755

The CVE-2005-4755 issue affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, where the SSL private key passphrase (CustomTrustKeyStorePassPhrase) is stored in cleartext in nodemanager.config, or rendered in cleartext during domain creation via the Configuration Wizard, visible on...

CVE-2005-4763

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol IIOP is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, are affected by an issue where the servlet root URL pattern (/) is not properly constrained, potentially allowing remote attackers to bypass intended protections. The vulnerability is described across multiple ...

CVE-2005-4765

BEA WebLogic Server/Express 8.1 SP4 and earlier and 7.0 SP6 and earlier are affected. When using weblogic.Deployer with the t3 protocol, it does not automatically fall back to the secure t3s protocol even if an Administration port is enabled on the Admin server, which may allow remote attackers t...