CVSS: 4.6EPSS: 0%CPEs: 24EXPL: 0CVE-2005-4752
https://notcve.org/view.php?id=CVE-2005-4752
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role. • http://dev2dev.bea.com/pub/advisory/142 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2005-4757
https://notcve.org/view.php?id=CVE-2005-4757
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections. • http://dev2dev.bea.com/pub/advisory/147 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.5EPSS: 2%CPEs: 69EXPL: 0CVE-2005-4750
https://notcve.org/view.php?id=CVE-2005-4750
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/138 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 2.1EPSS: 0%CPEs: 8EXPL: 0CVE-2005-4755
https://notcve.org/view.php?id=CVE-2005-4755
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys. • http://dev2dev.bea.com/pub/advisory/145 http://dev2dev.bea.com/pub/advisory/150 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.6EPSS: 0%CPEs: 36EXPL: 0CVE-2005-4765
https://notcve.org/view.php?id=CVE-2005-4765
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection. • http://dev2dev.bea.com/pub/advisory/156 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •