CVSS: 6.4EPSS: 0%CPEs: 24EXPL: 1CVE-2006-0419
https://notcve.org/view.php?id=CVE-2006-0419
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections. • http://dev2dev.bea.com/pub/advisory/163 http://securitytracker.com/id?1015528 •
CVSS: 5.0EPSS: 0%CPEs: 33EXPL: 0CVE-2005-4705
https://notcve.org/view.php?id=CVE-2005-4705
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection. • http://dev2dev.bea.com/pub/advisory/141 http://www.osvdb.org/20095 •
CVSS: 5.0EPSS: 0%CPEs: 40EXPL: 0CVE-2005-4749
https://notcve.org/view.php?id=CVE-2005-4749
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors. • http://dev2dev.bea.com/pub/advisory/159 http://dev2dev.bea.com/pub/advisory/177 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 http://www.securityfocus.com/bid/17163 •
CVSS: 5.0EPSS: 0%CPEs: 24EXPL: 0CVE-2005-4753
https://notcve.org/view.php?id=CVE-2005-4753
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection. • http://dev2dev.bea.com/pub/advisory/143 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 5.1EPSS: 0%CPEs: 20EXPL: 0CVE-2005-4760
https://notcve.org/view.php?id=CVE-2005-4760
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected." • http://dev2dev.bea.com/pub/advisory/151 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •