CVSS: 7.5EPSS: 1%CPEs: 30EXPL: 0CVE-2006-0430
https://notcve.org/view.php?id=CVE-2006-0430
25 Jan 2006 — Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown). • http://dev2dev.bea.com/pub/advisory/174 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2006-0431
https://notcve.org/view.php?id=CVE-2006-0431
25 Jan 2006 — Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/175 •
CVSS: 6.5EPSS: 0%CPEs: 33EXPL: 0CVE-2006-0424
https://notcve.org/view.php?id=CVE-2006-0424
25 Jan 2006 — BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information. • http://dev2dev.bea.com/pub/advisory/168 •
CVSS: 9.8EPSS: 1%CPEs: 43EXPL: 0CVE-2005-4763
https://notcve.org/view.php?id=CVE-2005-4763
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions. • http://dev2dev.bea.com/pub/advisory/154 •
CVSS: 9.8EPSS: 1%CPEs: 22EXPL: 0CVE-2005-4756
https://notcve.org/view.php?id=CVE-2005-4756
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges. • http://dev2dev.bea.com/pub/advisory/146 •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2005-4754
https://notcve.org/view.php?id=CVE-2005-4754
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation." • http://dev2dev.bea.com/pub/advisory/144 •
CVSS: 9.8EPSS: 0%CPEs: 68EXPL: 0CVE-2005-4764
https://notcve.org/view.php?id=CVE-2005-4764
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins). • http://dev2dev.bea.com/pub/advisory/155 •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2005-4704
https://notcve.org/view.php?id=CVE-2005-4704
31 Dec 2005 — Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges. • http://dev2dev.bea.com/pub/advisory/140 •
CVSS: 6.8EPSS: 1%CPEs: 42EXPL: 0CVE-2005-4751
https://notcve.org/view.php?id=CVE-2005-4751
31 Dec 2005 — Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/139 •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2005-4761
https://notcve.org/view.php?id=CVE-2005-4761
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used. • http://dev2dev.bea.com/pub/advisory/152 •