CVE-2004-0715

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-071610.0Buffer overflow in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11 allows remote attackers to execute arbitrary code vCVE-2004-07177.5Opera 7.51 for Windows and 7.50 for Linux does not properly prevent a frame in one domain from injecting content into a frame that belongs tCVE-2004-07187.5The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain fromCVE-2004-07197.5Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one doCVE-2004-07207.5Safari 1.2.2 does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilCVE-2004-07217.5Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame thatCVE-2004-072210.0Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versiCVE-2004-07236.4Microsoft Java virtual machine (VM) 5.0.0.3810 allows remote attackers to bypass sandbox restrictions to read or write certain data between CVE-2004-07245.0The Half-Life engine before July 7 2004 allows remote attackers to cause a denial of service (server or client crash) via an empty fragmenteCVE-2004-07256.8Cross-site scripting (XSS) vulnerability in help.php in Moodle 1.3.2 and 1.4 dev allows remote attackers to inject arbitrary web script or HCVE-2004-07267.5The Windows Media Player control in Microsoft Windows 2000 allows remote attackers to execute arbitrary script in the local computer zone viCVE-2004-07277.5Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers
CVE-2004-0715: Medium severity, CVSS 5.1 | Vulnix