CVSS: 9.8EPSS: 1%CPEs: 22EXPL: 0CVE-2005-4756
https://notcve.org/view.php?id=CVE-2005-4756
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges. • http://dev2dev.bea.com/pub/advisory/146 •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2005-4761
https://notcve.org/view.php?id=CVE-2005-4761
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used. • http://dev2dev.bea.com/pub/advisory/152 •
CVSS: 7.5EPSS: 0%CPEs: 69EXPL: 0CVE-2005-4750
https://notcve.org/view.php?id=CVE-2005-4750
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors. • http://dev2dev.bea.com/pub/advisory/138 •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2005-4752
https://notcve.org/view.php?id=CVE-2005-4752
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role. • http://dev2dev.bea.com/pub/advisory/142 •
CVSS: 9.8EPSS: 1%CPEs: 43EXPL: 0CVE-2005-4763
https://notcve.org/view.php?id=CVE-2005-4763
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions. • http://dev2dev.bea.com/pub/advisory/154 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2005-4759
https://notcve.org/view.php?id=CVE-2005-4759
31 Dec 2005 — BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages. • http://dev2dev.bea.com/pub/advisory/149 •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1749
https://notcve.org/view.php?id=CVE-2005-1749
24 May 2005 — Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping). • http://dev2dev.bea.com/pub/advisory/132 •
CVSS: 9.8EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1745
https://notcve.org/view.php?id=CVE-2005-1745
24 May 2005 — The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password. • http://dev2dev.bea.com/pub/advisory/128 •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1748
https://notcve.org/view.php?id=CVE-2005-1748
24 May 2005 — The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service. • http://dev2dev.bea.com/pub/advisory/131 •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2005-1743
https://notcve.org/view.php?id=CVE-2005-1743
24 May 2005 — BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions. • http://dev2dev.bea.com/pub/advisory/126 •