Bea

Weblogic Server

149 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5

CVE-2005-4749

  • EPSS 1.77%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.

7.5

CVE-2005-4750

  • EPSS 0.73%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.

6.8

CVE-2005-4751

  • EPSS 1.22%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrati...

4.6

CVE-2005-4752

  • EPSS 0.08%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer...

5

CVE-2005-4753

  • EPSS 1.13%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid dete...

5

CVE-2005-4754

  • EPSS 0.87%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."

2.1

CVE-2005-4755

  • EPSS 0.08%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private ke...

7.5

CVE-2005-4756

  • EPSS 1.55%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.

7.5

CVE-2005-4757

  • EPSS 0.23%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.

4

CVE-2005-4758

  • EPSS 0.34%
  • Published 31.12.2005 05:00:00
  • Last modified 03.04.2025 01:03:51

Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accesse...