CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3314
https://notcve.org/view.php?id=CVE-2021-3314
25 Jun 2021 — Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer... • https://n4nj0.github.io/advisories/oracle-glassfish-reflected-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 1%CPEs: 1EXPL: 0CVE-2018-2911
https://notcve.org/view.php?id=CVE-2018-2911
17 Oct 2018 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data o... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2018-3152
https://notcve.org/view.php?id=CVE-2018-3152
17 Oct 2018 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.5 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-3210
https://notcve.org/view.php?id=CVE-2018-3210
17 Oct 2018 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2018-14324
https://notcve.org/view.php?id=CVE-2018-14324
16 Jul 2018 — The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOTE: this is not an Oracle supported product. La característica demo en Oracle GlassFish Open Source Edition 5.0 tiene el puerto TCP 7676 abierto por defecto con un... • http://www.securitytracker.com/id/1041292 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-10385
https://notcve.org/view.php?id=CVE-2017-10385
19 Oct 2017 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Glass... • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-10391
https://notcve.org/view.php?id=CVE-2017-10391
19 Oct 2017 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Orac... • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-10393
https://notcve.org/view.php?id=CVE-2017-10393
19 Oct 2017 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Glass... • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10400
https://notcve.org/view.php?id=CVE-2017-10400
19 Oct 2017 — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to som... • http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html •
CVSS: 7.5EPSS: 62%CPEs: 1EXPL: 0CVE-2017-1000029
https://notcve.org/view.php?id=CVE-2017-1000029
13 Jul 2017 — Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication. Oracle, GlassFish Server Open Source Edition versión 3.0.1 (build 22), es susceptible a la vulnerabilidad de Inclusión de Archivos Locales, que hace posible incluir archivos arbitrarios en el servidor, esta vulnerabilidad puede ser explotada sin ninguna autentic... • https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-011/?fid=8037 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •