The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4 and 7.0 through Service Pack 5 allows remote anonymous binds which may allow remote attackers to view user entries or cause a denial of service.