CVSS: 4.6EPSS: 0%CPEs: 24EXPL: 0CVE-2005-4752
https://notcve.org/view.php?id=CVE-2005-4752
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role. • http://dev2dev.bea.com/pub/advisory/142 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2005-4757
https://notcve.org/view.php?id=CVE-2005-4757
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections. • http://dev2dev.bea.com/pub/advisory/147 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.5EPSS: 2%CPEs: 69EXPL: 0CVE-2005-4750
https://notcve.org/view.php?id=CVE-2005-4750
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/138 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.6EPSS: 0%CPEs: 36EXPL: 0CVE-2005-4765
https://notcve.org/view.php?id=CVE-2005-4765
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection. • http://dev2dev.bea.com/pub/advisory/156 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 6.8EPSS: 0%CPEs: 42EXPL: 0CVE-2005-4751
https://notcve.org/view.php?id=CVE-2005-4751
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/139 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •