# CVEs published 2006-04-01

27 CVEs were published on April 1, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4749](https://cve.now/CVE-2005-4749.md): HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and e (no CVSS)
- [CVE-2005-4750](https://cve.now/CVE-2005-4750.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a (no CVSS)
- [CVE-2005-4751](https://cve.now/CVE-2005-4751.md): Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlie (no CVSS)
- [CVE-2005-4752](https://cve.now/CVE-2005-4752.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using t (no CVSS)
- [CVE-2005-4753](https://cve.now/CVE-2005-4753.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect (no CVSS)
- [CVE-2005-4754](https://cve.now/CVE-2005-4754.md): BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) (no CVSS)
- [CVE-2005-4755](https://cve.now/CVE-2005-4755.md): BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleart (no CVSS)
- [CVE-2005-4756](https://cve.now/CVE-2005-4756.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with mult (no CVSS)
- [CVE-2005-4757](https://cve.now/CVE-2005-4757.md): BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet roo (no CVSS)
- [CVE-2005-4758](https://cve.now/CVE-2005-4758.md): Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authent (no CVSS)
- [CVE-2005-4759](https://cve.now/CVE-2005-4759.md): BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative u (no CVSS)
- [CVE-2005-4760](https://cve.now/CVE-2005-4760.md): BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a ser (no CVSS)
- [CVE-2005-4761](https://cve.now/CVE-2005-4761.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at serv (no CVSS)
- [CVE-2005-4762](https://cve.now/CVE-2005-4762.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot passwor (no CVSS)
- [CVE-2005-4763](https://cve.now/CVE-2005-4763.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (no CVSS)
- [CVE-2005-4764](https://cve.now/CVE-2005-4764.md): BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which (no CVSS)
- [CVE-2005-4765](https://cve.now/CVE-2005-4765.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 p (no CVSS)
- [CVE-2005-4766](https://cve.now/CVE-2005-4766.md): BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow r (no CVSS)
- [CVE-2005-4767](https://cve.now/CVE-2005-4767.md): BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not (no CVSS)
- [CVE-2006-1567](https://cve.now/CVE-2006-1567.md): Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitr (no CVSS)
- [CVE-2006-1568](https://cve.now/CVE-2006-1568.md): Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2006-1569](https://cve.now/CVE-2006-1569.md): Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) pa (no CVSS)
- [CVE-2006-1570](https://cve.now/CVE-2006-1570.md): Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unkn (no CVSS)
- [CVE-2006-1571](https://cve.now/CVE-2006-1571.md): Multiple SQL injection vulnerabilities in loginprocess.php in qliteNews 2005.07.01 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-1572](https://cve.now/CVE-2006-1572.md): SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a (no CVSS)
- [CVE-2006-1573](https://cve.now/CVE-2006-1573.md): PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2006-1574](https://cve.now/CVE-2006-1574.md): Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web, World Wide Web Desktop, World Wide Web for Scheduler, and Desktop for S (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.