BEA WebLogic Server Multiple Vulnerabilities

Binary data 3618.prm...

CVE-2005-4758

Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP...

CVE-2005-4753

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection...

CVE-2005-4767

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password...

CVE-2005-4755

The CVE-2005-4755 issue affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, where the SSL private key passphrase (CustomTrustKeyStorePassPhrase) is stored in cleartext in nodemanager.config, or rendered in cleartext during domain creation via the Configuration Wizard, visible on...

CVE-2005-4759

BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages...

CVE-2005-4766

CVE-2005-4766 affects BEA WebLogic Server and WebLogic Express; versions 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic. The root cause is lack of encryption for multicast communications, which could allow an attacker to read sensitive cluster synchronization messa...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, are affected by an issue where the servlet root URL pattern (/) is not properly constrained, potentially allowing remote attackers to bypass intended protections. The vulnerability is described across multiple ...

CVE-2005-4753

CVE-2005-4753 affects BEA WebLogic Server and WebLogic Express: 8.1 SP4 and earlier, and 7.0 SP6 and earlier. The issue is the reporting of incorrect severity levels for an audit event in certain “heavy usage” scenarios, which might allow attackers to perform unauthorized actions and avoid detect...

CVE-2005-4761

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information passwords or keyphrases in the server log file when the -D option is used...

CVE-2005-4765

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to...

CVE-2005-4762

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges...

CVE-2005-4755

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier 1 stores the private key passphrase CustomTrustKeyStorePassPhrase in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext 2 on a terminal or 3 in a...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" slash servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections...

CVE-2005-4754

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information intranet IP addresses via unknown attack vectors involving "network address translation."...

CVE-2005-4764

CVE-2005-4764 affects BEA WebLogic Server and WebLogic Express versions 9.0, 8.1, and 7.0. The issue causes the admin user account to be locked out after multiple incorrect password guesses, enabling remote attackers who know or guess the admin username to cause a denial of service via blocked ad...

CVE-2005-4759

CVE-2005-4759 affects BEA WebLogic Server and WebLogic Express 8.1 and 7.0. During OS platform migrations, it does not warn the admin about URLResource case-sensitivity differences, which may cause local users to inadvertently lose protection of Web Application pages. The NVD metrics show a base ...

CVE-2005-4758

CVE-2005-4758 affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier. The vulnerability arises in the Administration server, allowing remote authenticated Admin users to read arbitrary files through an internal servlet accessed via HTTP. The description characterizes the flaw as uns...

CVE-2005-4749

CVE-2005-4749 describes an HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express. Affected products include WebLogic Server/Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The flaw allows remote attackers to inject arbitrary HTTP headers via u...

CVE-2005-4762

CVE-2005-4762 affects BEA WebLogic Server and WebLogic Express versions 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. The boot password is stored in the registry in cleartext, which might allow local users to gain administrative privileges. Connected sources corroborate the a...