Due to the lack of effective message integrity the following attacks are feasible:
initialization vector reply attacks
bit-flipping attacks
man-in-the middle attacks
All these attacks have been practically implemented! Aireplay, WEPWedgie, Chopchop, Airjack