CVE-2006-2432

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2006-2432

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2006-2432

CVE-2006-2432 affects IBM WebSphere Application Server 5.0.2 (and earlier cumulative fixes) and 5.1.1 (and earlier cumulative fixes); on Solaris, a crafted LTPA token enables EJB access. The NVD entry assigns a CVSSv2 base score of 7.5 (HIGH) with network attack vector, low attack complexity, and...

CVE-2006-2432: Undefined Security Weakness

IBM WebSphere Application Server 5.0.2 or any earlier cumulative fix and 5.1.1 or any earlier cumulative fix allows EJB access on Solaris systems via a crafted LTPA token...

CVE-2005-4709

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans EJB 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an...

CVE-2005-4709

The CVE concerns JBoss EJB 3.0 RC3. The popSubjectContext method in SecurityAssociation preserves threadPrincipal and threadCredential from a prior client after the session ends, enabling a remote attacker to assume the roles of that previous client on the same server thread. This is described as...

CVE-2005-4709: Undefined Security Weakness

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans EJB 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an...

CVE-2006-0427

Vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords by accessing restricted functionality. Affects BEA WebLogic products with limited confidentiality impact (partial). Exploit details, root cau...

CVE-2005-4709

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans EJB 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an...

CVE-2004-0713

The remove method in a stateful Enterprise JavaBean EJB in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from...

CVE-2004-0713

The CVE-2004-0713 case affects BEA WebLogic Server and WebLogic Express, versions 8.1–SP2, 7.0–SP4, and 6.1–SP6. The vulnerability is in the remove method of a stateful Enterprise JavaBean (EJB), where EJB permissions are not properly checked before unexporting a bean. This allows remote authenti...

CVE-2004-0713: Undefined Security Weakness

The remove method in a stateful Enterprise JavaBean EJB in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from...

BEA WebLogic Server allows unauthorized removal of EJB objects

Overview There is a vulnerability in the BEA WebLogic Server that could allow the unauthorized removal of an Enterprise JavaBean EJB. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating, securing, and managing...