CVE-2026-2586

認証済みGlassFish ELインジェクション RCE CVE-2026-2586 GlassFish管理コンソールにおけるExpression Language（EL）インジェクションの脆弱性により、認証済みユーザーが管理用Webインターフェースで処理されるパラメータに悪意のあるEL式を注入できる可能性があります。悪用に成功すると、影響を受けるサーバー上でリモートコード実行につながる可能性があります。 この脆弱性は、アプリケーションがユーザー制御のパラメータを安全でない方法で解釈する、サーバーの仮想構成編集フローにおいて確認されました。 この脆弱性が発生する理由は次のとおりです。...

GHSA-96V6-HQ43-X9H4 GlassFish's Administration Console is Vulnerable to RCE

An authenticated Remote Code Execution RCE vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user...

CVE-2014-2609

The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116...

CVE-2014-2609: Improper Authentication

The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116...

PT-2014-4813

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41 Description The Java Glassfish Admin Console does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001. Recommendations For versions...

Hewlett-Packard IT Executive Scorecard Java Glassfish Admin Console Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard IT Executive Scorecard. Authentication is not required to exploit this vulnerability. The specific flaw exists within allowed HTTP access to a Glassfish administrative console on po...