123 matches found
CVE-2026-2587-Exploit-POC
CVE-2026-2587 漏洞验证PoC — Eclipse GlassFish EL注入远程代码执行验证工具 CVE-2026-2587的安全PoC验证器，这是一个影响Eclipse GlassFish管理控制台组件处理（通过/common/gadgets/gadget.jsf）的严重EL注入/远程代码执行漏洞。 该工具帮助安全团队使用良性的算术EL检测值，在授权环境中验证GlassFish CVE-2026-2587的暴露风险。 分配者: Eclipse Foundation CNA · 发布时间: 2026年5月19日 CVSS: 9.6 Critical ·...
CVE-2018-14324-Exploit
Hackeando Eclipse GlassFish - CVE-2018-14324 La descripción de CVE-2018-14324 no explica completamente el impacto de esta vulnerabilidad. En resumen, tienes acceso a Java Management Extensions JMX mediante credenciales hardcodeadas admin:admin. Si bien el impacto se enumera como " información...
Glassfish-research
Investigación de Seguridad de GlassFish Investigación de vulnerabilidades en la consola de administración de Eclipse GlassFish. CVE| Problema| Severidad| Estado ---|---|---|--- CVE-2026-2586| Inyección EL → RCE| 9.1 Crítico| Corregido en 8.0.2 —| —| —| Divulgación pendiente CVE-2026-2586 —...
CVE-2026-12605
The CVE-2026-12605 affects Eclipse GlassFish 8.0.x before 8.0.4. A CSRF + SSRF flaw in DownloadServlet ContentSources allows leakage of the admin gfresttoken to an attacker-controlled host when the victim is authenticated in the Admin Console, enabling full unauthenticated takeover of the GlassFi...
CVE-2026-12605
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
EUVD-2026-53925
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
CVE-2026-12605: Server-Side Request Forgery (SSRF)
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...
Eclipse Glassfish 代码注入漏洞
Eclipse Glassfish is an application server developed by the Eclipse Foundation. Eclipse Glassfish has a code injection vulnerability. This vulnerability stems from allowing users with panel access rights to send custom requests, thereby enabling them to execute arbitrary operating system commands...
CVE-2026-2587: Improper Neutralization of Special Elements used in an Expression Language Statement
A critical Remote Code Execution RCE vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language EL “expressions” are processed...
EUVD-2024-54789
Malicious code in bioql PyPI...
EUVD-2024-54788
Malicious code in bioql PyPI...
EUVD-2024-54790
Malicious code in bioql PyPI...
EUVD-2024-2827
Malicious code in bioql PyPI...
EUVD-2024-54792
Malicious code in bioql PyPI...
EUVD-2024-54793
Malicious code in bioql PyPI...
EUVD-2024-2746
Malicious code in bioql PyPI...
EUVD-2024-54791
Malicious code in bioql PyPI...
EUVD-2023-2849
Malicious code in bioql PyPI...
EUVD-2023-0320
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-2712
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'...