131 matches found
CVE-2018-14324-Exploit
Hacking Eclipse GlassFish - CVE-2018-14324 The description of CVE-2018-14324 does not fully explain the impact of this vulnerability. TLDR you have access to Java Management Extensions JMX via hardcoded admin:admin creds. While impact is listed as " potentially sensitive information, perform...
CVE-2026-2587-Exploit-POC
CVE-2026-2587 Exploit PoC — Eclipse GlassFish EL Injection RCE Validator Safe PoC validator for CVE-2026-2587, a critical EL Injection / RCE issue affecting Eclipse GlassFish admin console gadget handling via /common/gadgets/gadget.jsf. This tool helps security teams validate GlassFish...
Glassfish-research
GlassFish Security Research Vulnerability research on the Eclipse GlassFish administration console. CVE| Issue| Severity| Status ---|---|---|--- CVE-2026-2586| EL injection → RCE| 9.1 Critical| Fixed in 8.0.2 —| —| —| Pending disclosure CVE-2026-2586 — EL Injection to RCE Affected: 8.0.2 · CWE-91...
CVE-2026-12605
The CVE-2026-12605 affects Eclipse GlassFish 8.0.x before 8.0.4. A CSRF + SSRF flaw in DownloadServlet ContentSources allows leakage of the admin gfresttoken to an attacker-controlled host when the victim is authenticated in the Admin Console, enabling full unauthenticated takeover of the GlassFi...
EUVD-2026-53925
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
CVE-2026-12605
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
PT-2026-68489
Name of the Vulnerable Software and Affected Versions Eclipse GlassFish versions 8.0.x through 8.0.3 Description A combination of Cross-Site Request Forgery CSRF and Server-Side Request Forgery SSRF exists in the DownloadServlet ContentSources. This issue allows an attacker to leak the admin...
CVE-2026-12605: Server-Side Request Forgery (SSRF)
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
CVE-2026-2587: Improper Neutralization of Special Elements used in an Expression Language Statement
A critical Remote Code Execution RCE vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language EL “expressions” are processed...
Eclipse Glassfish code injection vulnerability
Eclipse Glassfish is an application server developed by the Eclipse Foundation. Eclipse Glassfish has a code injection vulnerability. This vulnerability stems from allowing users with panel access rights to send custom requests, thereby enabling them to execute arbitrary operating system commands...
EUVD-2024-54791
Malicious code in bioql PyPI...
EUVD-2024-2746
Malicious code in bioql PyPI...
EUVD-2024-54790
Malicious code in bioql PyPI...
EUVD-2024-54788
Malicious code in bioql PyPI...
EUVD-2024-2827
Malicious code in bioql PyPI...
EUVD-2023-0320
Malicious code in bioql PyPI...
EUVD-2023-2849
Malicious code in bioql PyPI...
EUVD-2024-54793
Malicious code in bioql PyPI...