CVE-2004-1755

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jspPatch
http://secunia.com/advisories/10725Patch
http://www.kb.cert.org/vuls/id/858990Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/9502Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/15826
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_47.00.jspPatch
http://secunia.com/advisories/10725Patch
http://www.kb.cert.org/vuls/id/858990Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/9502Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/15826

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-17565.0BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may CVE-2004-17574.6BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users CVE-2004-17584.6BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and passwor CVE-2004-17595.0Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, allows remote attackers to cause a denial of se CVE-2004-176010.0The default installation of Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, does not require au CVE-2004-17615.0Unknown vulnerability in Ethereal 0.8.13 to 0.10.2 allows attackers to cause a denial of service (segmentation fault) via a malformed color CVE-2004-17627.5Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.CVE-2004-176310.0Buffer overflow in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (cras CVE-2004-17647.2Buffer overflow in CDE libDtSvc on HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows local users to gain root privileges via unknown vecto CVE-2004-17657.5Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to CVE-2004-17665.0The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices runni CVE-2004-17677.2The kernel in Solaris 2.6, 7, 8, and 9 allows local users to gain privileges by loading arbitrary loadable kernel modules (LKM), possibly in