CVE-2005-4767

CVE-2005-4767 affects BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier. The issue is that, when using username/password authentication, the server does not lock out a username after the maximum number of invalid login attempts, enabling easier guessing of pass...

CVE-2005-4749

CVE-2005-4749 describes an HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express. Affected products include WebLogic Server/Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The flaw allows remote attackers to inject arbitrary HTTP headers via u...

CVE-2005-4750

CVE-2005-4750 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier. It allows remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. The provided documents do not include concrete exploit details...

CVE-2005-4752

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, are affected by CVE-2005-4752. The vulnerability allows local users to elevate privileges by abusing the run-as deployment descriptor element to change a web application or EJB from the Deployer security role t...

CVE-2005-4763

CVE-2005-4763 affects BEA WebLogic Server and WebLogic Express (8.1 SP4 and earlier; 7.0 SP6 and earlier; 6.1 SP7 and earlier) where IIOP usage can leak a password in an exception message or logged output, potentially enabling remote attackers to perform unauthorized actions. The vulnerability is...

CVE-2005-4761

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information passwords or keyphrases in the server log file when the -D option is used...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" slash servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections...

CVE-2005-4754

CVE-2005-4754 affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier. The issue allows remote attackers to obtain sensitive information (intranet IP addresses) through unspecified attack vectors related to network address translation. The connected sources confirm the affected produ...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, are affected by an issue where the servlet root URL pattern (/) is not properly constrained, potentially allowing remote attackers to bypass intended protections. The vulnerability is described across multiple ...

CVE-2005-4759

CVE-2005-4759 affects BEA WebLogic Server and WebLogic Express 8.1 and 7.0. During OS platform migrations, it does not warn the admin about URLResource case-sensitivity differences, which may cause local users to inadvertently lose protection of Web Application pages. The NVD metrics show a base ...

CVE-2005-4762

CVE-2005-4762 affects BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The boot password is stored in the registry in cleartext, which might allow local users to gain administrative privileges. Connected sources corroborate the a...

CVE-2005-4753

CVE-2005-4753 affects BEA WebLogic Server and WebLogic Express: 8.1 SP4 and earlier, and 7.0 SP6 and earlier. The issue is the reporting of incorrect severity levels for an audit event in certain “heavy usage” scenarios, which might allow attackers to perform unauthorized actions and avoid detect...

CVE-2005-4755

The CVE-2005-4755 issue affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, where the SSL private key passphrase (CustomTrustKeyStorePassPhrase) is stored in cleartext in nodemanager.config, or rendered in cleartext during domain creation via the Configuration Wizard, visible on...

CVE-2006-1352

CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...

[SA19310] BEA WebLogic Server/Express Two Vulnerabilities

TITLE: BEA WebLogic Server/Express Two Vulnerabilities SECUNIA ADVISORY ID: SA19310 VERIFY ADVISORY: http://secunia.com/advisories/19310/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: BEA WebLogic Server 8...

CVE-2005-4705

BEA WebLogic Server/Express insecure connection handling: when a Java client opens an SSL connection after an insecure one, the SSL session may be downgraded and the connection can be sniffed. Affected: WebLogic Server/Express 6.1 SP7, 7.0 SP6, 8.1 SP4 and earlier. Root cause described as returni...

CVE-2005-4704

Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network...

CVE-2005-4704

The CVE-2005-4704 entry describes an unspecified vulnerability in BEA WebLogic Server and WebLogic Express (versions 8.1–SP3, 7.0–SP6, 6.1–SP7) where, when SSL is intended to be used, an unencrypted protocol is used in certain circumstances. This leads to user credentials being sent in the clear ...

Code injection

Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service server slowdown...

CVE-2006-0430

Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service server slowdown...