CVE-2005-4767

CVE-2005-4767 affects BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier. The issue is that, when using username/password authentication, the server does not lock out a username after the maximum number of invalid login attempts, enabling easier guessing of pass...

CVE-2005-4750

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service server thread hang via unknown attack vectors...

CVE-2005-4763

CVE-2005-4763 affects BEA WebLogic Server and WebLogic Express (8.1 SP4 and earlier; 7.0 SP6 and earlier; 6.1 SP7 and earlier) where IIOP usage can leak a password in an exception message or logged output, potentially enabling remote attackers to perform unauthorized actions. The vulnerability is...

CVE-2005-4766

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic...

CVE-2005-4750

CVE-2005-4750 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier. It allows remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. The provided documents do not include concrete exploit details...

CVE-2005-4751

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors...

CVE-2005-4751

CVE-2005-4751 describes multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express. Affected versions include WebLogic Server/Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. Attackers could inject arbitrary web script or HTML an...

CVE-2005-4756

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, are described as vulnerable due to improper validation of derived Principals when multiple PrincipalValidators are involved, potentially allowing privilege escalation. The Connected documents reiterate the affe...

Code injection

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

BEA WebLogic Portal 8.1 up to SP5 exposes a session-cache leakage in JSR-168 Portlets, allowing one user to view another user’s Portlet. Root cause: Portlet retrieval from cache for the wrong session. Impact: partial confidentiality breach. Remediation: apply the SP5 patch (CR259534_81SP5.zip) as...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

Design/Logic Flaw

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

Design/Logic Flaw

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1351

CVE-2006-1351 affects BEA WebLogic Server 6.1 SP7 and earlier. Affected component: the server’s HTTP-accessible default internal servlet, with a root cause described only as unknown attack vectors. Impact: remote attackers could read arbitrary files. No remediation details are provided in the con...

CVE-2006-1352

CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...