Oracle Glassfish Server vulnerabilities

CVE-2021-3314 [MEDIUM] CWE-79 CVE-2021-3314: Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious u Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter i

CVE-2018-2911 [HIGH] CVE-2018-2911: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ja Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person othe

CVE-2018-3152 [HIGH] CVE-2018-3152: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ad Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorize

CVE-2018-3210 [MEDIUM] CVE-2018-3210: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ja Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauth

CVE-2018-14324 [CRITICAL] CWE-798 CVE-2018-14324: The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOT

CVE-2017-10391 [HIGH] CVE-2017-10391: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ad Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in

CVE-2017-10400 [MEDIUM] CVE-2017-10400: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ad Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human inte

CVE-2017-10385 [MEDIUM] CVE-2017-10385: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: We Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a pe

CVE-2017-10393 [MEDIUM] CVE-2017-10393: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: We Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a pe

CVE-2017-1000030 [CRITICAL] CWE-287 CVE-2017-1000030: Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Passwo Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain text password of administrative user and grant access to the web-based administration interface.

CVE-2017-1000029 [HIGH] CWE-200 CVE-2017-1000029: Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.

CVE-2017-1000028 [HIGH] CWE-22 CVE-2017-1000028: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthentic Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.

CVE-2017-3626 [LOW] CVE-2017-3626: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ja Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. Successful attacks require human interaction fro

CVE-2016-5528 [CRITICAL] CVE-2016-5528: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Se Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. While the vulnerability is in Oracle

CVE-2017-3249 [HIGH] CVE-2017-3249: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Se Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in u

CVE-2017-3250 [HIGH] CWE-200 CVE-2017-3250: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Se Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can res

CVE-2017-3247 [MEDIUM] CVE-2017-3247: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Co Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person

CVE-2017-3239 [LOW] CWE-200 CVE-2017-3239: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Ad Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successf

CVE-2016-5519 [HIGH] CVE-2016-5519: Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Java Server Faces.

CVE-2016-3607 [CRITICAL] CVE-2016-3607: Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.