CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1746
https://notcve.org/view.php?id=CVE-2005-1746
24 May 2005 — The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies. • http://dev2dev.bea.com/pub/advisory/129 •
CVSS: 6.8EPSS: 3%CPEs: 76EXPL: 0CVE-2005-1747
https://notcve.org/view.php?id=CVE-2005-1747
24 May 2005 — Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMI... • http://dev2dev.bea.com/pub/advisory/130 •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1748
https://notcve.org/view.php?id=CVE-2005-1748
24 May 2005 — The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service. • http://dev2dev.bea.com/pub/advisory/131 •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1749
https://notcve.org/view.php?id=CVE-2005-1749
24 May 2005 — Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping). • http://dev2dev.bea.com/pub/advisory/132 •
CVSS: 6.8EPSS: 1%CPEs: 15EXPL: 4CVE-2005-1380 – BEA WebLogic Server 8.1 / WebLogic Express Administration Console - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-1380
02 May 2005 — Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action. • https://www.exploit-db.com/exploits/25546 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2005-0432
https://notcve.org/view.php?id=CVE-2005-0432
15 Feb 2005 — BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA05-74.00.jsp •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 0CVE-2004-1755
https://notcve.org/view.php?id=CVE-2004-1755
31 Dec 2004 — The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jsp •
CVSS: 7.8EPSS: 0%CPEs: 46EXPL: 0CVE-2004-1757
https://notcve.org/view.php?id=CVE-2004-1757
31 Dec 2004 — BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges. • http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp •
CVSS: 5.8EPSS: 7%CPEs: 85EXPL: 0CVE-2004-2320 – Micro Focus Security Bulletin MFSBGN03812 1
https://notcve.org/view.php?id=CVE-2004-2320
31 Dec 2004 — The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting. A potential security vulnerability has been identified in Micro Focus Application Performance Management. The vulnerability could be remotely exploited to remote cross-site tracing ... • http://dev2dev.bea.com/pub/advisory/68 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2004-2321
https://notcve.org/view.php?id=CVE-2004-2321
31 Dec 2004 — BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword. • http://dev2dev.bea.com/pub/advisory/1 •