CVSS: 4.6EPSS: 0%CPEs: 4EXPL: 0CVE-2006-0421
https://notcve.org/view.php?id=CVE-2006-0421
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended. • http://dev2dev.bea.com/pub/advisory/165 http://secunia.com/advisories/18581 http://securitytracker.com/id?1015528 http://www.securityfocus.com/bid/16358 http://www.vupen.com/english/advisories/2006/0313 https://exchange.xforce.ibmcloud.com/vulnerabilities/24286 •
CVSS: 5.0EPSS: 0%CPEs: 33EXPL: 0CVE-2005-4705
https://notcve.org/view.php?id=CVE-2005-4705
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection. • http://dev2dev.bea.com/pub/advisory/141 http://www.osvdb.org/20095 •
CVSS: 5.0EPSS: 0%CPEs: 40EXPL: 0CVE-2005-4749
https://notcve.org/view.php?id=CVE-2005-4749
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors. • http://dev2dev.bea.com/pub/advisory/159 http://dev2dev.bea.com/pub/advisory/177 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 http://www.securityfocus.com/bid/17163 •
CVSS: 5.0EPSS: 0%CPEs: 24EXPL: 0CVE-2005-4753
https://notcve.org/view.php?id=CVE-2005-4753
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection. • http://dev2dev.bea.com/pub/advisory/143 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 5.1EPSS: 0%CPEs: 20EXPL: 0CVE-2005-4760
https://notcve.org/view.php?id=CVE-2005-4760
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected." • http://dev2dev.bea.com/pub/advisory/151 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •