CVE-2005-4767

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dev2dev.bea.com/pub/advisory/161Patch, Vendor Advisory
http://dev2dev.bea.com/pub/advisory/178Patch, Vendor Advisory
http://secunia.com/advisories/17138Patch, Vendor Advisory
http://www.securityfocus.com/bid/15052Patch
http://www.securityfocus.com/bid/17168Patch
http://dev2dev.bea.com/pub/advisory/161Patch, Vendor Advisory
http://dev2dev.bea.com/pub/advisory/178Patch, Vendor Advisory
http://secunia.com/advisories/17138Patch, Vendor Advisory
http://www.securityfocus.com/bid/15052Patch
http://www.securityfocus.com/bid/17168Patch

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-47687.5SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL command CVE-2005-47697.5SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via CVE-2005-47707.5SQL injection vulnerability in an unspecified Accelerated Enterprise Solutions product, possibly Accelerated E Solutions, allows remote atta CVE-2005-47714.6Trusted Mobility Agent PC Policy in Trust Digital Trusted Mobility Suite provides a cancel button that bypasses the domain-authentication pr CVE-2005-47726.4liby2util in Yet another Setup Tool (YaST) in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote reposito CVE-2005-47734.9The configuration of VMware ESX Server 2.x, 2.0.x, 2.1.x, and 2.5.x allows local users to cause a denial of service (shutdown) via the (1) h CVE-2005-47744.3Cross-site scripting (XSS) vulnerability in Xerver 4.17 allows remote attackers to inject arbitrary web script or HTML after a /%00/ sequenc CVE-2005-47755.0Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a w CVE-2005-47767.2Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; a CVE-2005-47774.9Tashcom ASPEdit 2.9 stores the administration password (aka the FTP password) in cleartext in the registry, which might allow local users to CVE-2005-47782.1The powersave daemon in SUSE Linux 10.0 before 20051007 has an unspecified "configuration problem," which allows local users to suspend the CVE-2005-47793.6verifiedexecioctl in verified_exec.c in NetBSD 2.0.2 calls NDINIT with UIO_USERSPACE rather than UID_SYSSPACE, which removes the functionali