CVSS: 6.8EPSS: 0%CPEs: 42EXPL: 0CVE-2005-4751
https://notcve.org/view.php?id=CVE-2005-4751
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/139 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 5.4EPSS: 0%CPEs: 33EXPL: 0CVE-2005-4766
https://notcve.org/view.php?id=CVE-2005-4766
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic. • http://dev2dev.bea.com/pub/advisory/157 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 4.3EPSS: 8%CPEs: 1EXPL: 1CVE-2005-2092
https://notcve.org/view.php?id=CVE-2005-2092
BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." • http://seclists.org/lists/bugtraq/2005/Jun/0025.html http://securitytracker.com/id?1014366 http://www.securiteam.com/securityreviews/5GP0220G0U.html http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/42901 •
CVSS: 5.0EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1746
https://notcve.org/view.php?id=CVE-2005-1746
The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies. • http://dev2dev.bea.com/pub/advisory/129 http://secunia.com/advisories/15486 http://securitytracker.com/id?1014049 http://www.securityfocus.com/bid/13717 http://www.vupen.com/english/advisories/2005/0606 •
CVSS: 6.8EPSS: 96%CPEs: 76EXPL: 0CVE-2005-1747
https://notcve.org/view.php?id=CVE-2005-1747
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password. • http://dev2dev.bea.com/pub/advisory/130 http://marc.info/?l=bugtraq&m=111695844803328&w=2 http://marc.info/?l=bugtraq&m=111695921212456&w=2 http://marc.info/?l=bugtraq&m=111722298705561&w=2 http://marc.info/?l=bugtraq&m=111722380313416&w=2 http://secunia.com/advisories/15486 http://securitytracker.com/id? •