CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2011-4358
https://notcve.org/view.php?id=CVE-2011-4358
Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect confidentiality and integrity, related to JSF. Vulnerabilidad sin especificar en Oracle GlassFish Enterprise Server v3.0.1 y v3.1.1 que permite a atacantes remotos afectar a la confidencialidad y la integridad, en relación con JSF. • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.securitytracker.com/id?1027277 •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2011-3559
https://notcve.org/view.php?id=CVE-2011-3559
Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container. Vulnerabilidad no especificada en Oracle Communications Server v2.0, GlassFish Enterprise Server v2.1.1, v3.0.1, y v3.1.1, y Sun Java System App Server v8.1 y v8.2 permite a atacantes remotos afectar a la disponibilidad a través de vectores desconocidos relacionados con Web Container. • http://osvdb.org/76476 http://secunia.com/advisories/46523 http://secunia.com/advisories/46524 http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html http://www.securityfocus.com/bid/50204 http://www.securitytracker.com/id?1026222 https://exchange.xforce.ibmcloud.com/vulnerabilities/70816 •
CVSS: 10.0EPSS: 96%CPEs: 4EXPL: 2CVE-2011-0807 – Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0807
Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration. Vulnerabilidad no especificada en Oracle Sun GlassFish Enterprise Server v2.1, v2.1.1 y v3.0.1, y Sun Java System Application Server v9.1, permite a atacantes remotos afectar a la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con la Administración. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle GlassFish Application Server and Oracle Java Application Server. Authentication is not required to exploit this vulnerability. The flaw exists within the Web Administration component which listens by default on TCP port 4848. When handling a malformed GET request to the administrative interface, the application does not properly handle an exception allowing the request to proceed without authentication. • https://www.exploit-db.com/exploits/17615 http://securityreason.com/securityalert/8327 http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/glassfish_deployer.rb •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2010-4438
https://notcve.org/view.php?id=CVE-2010-4438
Unspecified vulnerability in Oracle GlassFish 2.1, 2.1.1, and 3.0.1, and Java System Message Queue 4.1 allows local users to affect confidentiality, integrity, and availability, related to Java Message Service (JMS). Vulnerabilidad no especificada en Oracle GlassFish v2.1, v2.1.1 y v3.0.1, y Java System Message Queue v4.1 permite a usuarios locales afectar a la confidencialidad, integridad y disponibilidad, relacionado con Java Message Service (JMS). • http://osvdb.org/70572 http://osvdb.org/70573 http://secunia.com/advisories/42988 http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html http://www.securityfocus.com/bid/45890 http://www.vupen.com/english/advisories/2011/0155 https://exchange.xforce.ibmcloud.com/vulnerabilities/64813 •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 4CVE-2009-1554 – Woodstock 4.2 404 - Error Page Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1554
Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise Server and other products, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 string in the PATH_INFO, which is displayed on the 404 error page, as demonstrated by the PATH_INFO to theme/META-INF. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en ThemeServlet.java in Sun Woodstock v4.2 usado en Sun GlassFish Enterprise Server y otros productos, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de una cadena UTF-7 en PATH_INFO, lo que muestra un error 404 en la página web, como se ha demostrado mediante PATH_INFO a theme/META-INF. • https://www.exploit-db.com/exploits/32987 http://dsecrg.com/pages/vul/show.php?id=138 http://osvdb.org/54220 http://secunia.com/advisories/35006 http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html http://www.securityfocus.com/archive/1/503239/100/0/threaded http://www.securityfocus.com/bid/34829 https://exchange.xforce.ibmcloud.com/vulnerabiliti • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •