CVSS: 2.1EPSS: 0%CPEs: 8EXPL: 0CVE-2005-4755
https://notcve.org/view.php?id=CVE-2005-4755
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys. • http://dev2dev.bea.com/pub/advisory/145 http://dev2dev.bea.com/pub/advisory/150 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 7.6EPSS: 0%CPEs: 36EXPL: 0CVE-2005-4765
https://notcve.org/view.php?id=CVE-2005-4765
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection. • http://dev2dev.bea.com/pub/advisory/156 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 6.8EPSS: 0%CPEs: 42EXPL: 0CVE-2005-4751
https://notcve.org/view.php?id=CVE-2005-4751
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/139 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 5.4EPSS: 0%CPEs: 33EXPL: 0CVE-2005-4766
https://notcve.org/view.php?id=CVE-2005-4766
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic. • http://dev2dev.bea.com/pub/advisory/157 http://secunia.com/advisories/17138 http://www.securityfocus.com/bid/15052 •
CVSS: 4.3EPSS: 8%CPEs: 1EXPL: 1CVE-2005-2092
https://notcve.org/view.php?id=CVE-2005-2092
BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." • http://seclists.org/lists/bugtraq/2005/Jun/0025.html http://securitytracker.com/id?1014366 http://www.securiteam.com/securityreviews/5GP0220G0U.html http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/42901 •