CVE-2005-4749

HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors...

CVE-2005-4767

CVE-2005-4767 affects BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier. The issue is that, when using username/password authentication, the server does not lock out a username after the maximum number of invalid login attempts, enabling easier guessing of pass...

CVE-2005-4752

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role...

CVE-2005-4750

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service server thread hang via unknown attack vectors...

CVE-2005-4750

CVE-2005-4750 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier. It allows remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. The provided documents do not include concrete exploit details...

CVE-2005-4754

CVE-2005-4754 affects BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier. The issue allows remote attackers to obtain sensitive information (intranet IP addresses) through unspecified attack vectors related to network address translation. The connected sources confirm the affected produ...

CVE-2005-4751

Multiple cross-site scripting XSS vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors...

CVE-2005-4751

CVE-2005-4751 describes multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express. Affected versions include WebLogic Server/Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier. Attackers could inject arbitrary web script or HTML an...

Code injection

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user...

CVE-2006-1358

BEA WebLogic Portal 8.1 up to SP5 exposes a session-cache leakage in JSR-168 Portlets, allowing one user to view another user’s Portlet. Root cause: Portlet retrieval from cache for the wrong session. Impact: partial confidentiality breach. Remediation: apply the SP5 patch (CR259534_81SP5.zip) as...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

Design/Logic Flaw

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

Design/Logic Flaw

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1352

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service memory exhaustion via crafted non-canonicalized XML documents...

CVE-2006-1352

CVE-2006-1352 affects BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier. The vulnerability allows remote attackers to cause a denial of service via crafted non-canonicalized XML documents, leading to memory exhaustion. The d...

CVE-2006-1351

BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP...

CVE-2006-1351

CVE-2006-1351 affects BEA WebLogic Server 6.1 SP7 and earlier. Affected component: the server’s HTTP-accessible default internal servlet, with a root cause described only as unknown attack vectors. Impact: remote attackers could read arbitrary files. No remediation details are provided in the con...