Insecure Defaults

Glassfish is found to be using insecure defaults. Glassfish supports SSLv3 by default, it has been proven to be insecure and was officially deprecated by the IETF in June 2015...

Remote Code Execution (RCE)

Glassfish is vulnerable to remote code execution. It is because the JMXMPConnectorStarter is not updated to consider Oracle’s fix for CVE-2016-3427 where a remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. Therefore,...

Remote Code Execution (RCE)

glassfish web-core is susceptible to remote code execution. It does not prevent NULL \0 byte injection in repository path of PartItem, allowing potential file manipulation via Java object deserialization. Moreover, it does not validate the existence of the NULL \0 byte when an older Java VM is...

Directory Traversal

Glassfish admin is vulnerable to directory traversal attacks. These attacks are possible through a string such as http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/config/asenv.conf. Attackers can view files outside of the intended scope...

Remote Code Execution (RCE)

Glassfish is vulnerable to remote code execution RCE. A malicious user can log into the admin account by passing null as the password. The user once logged in can deploy and execute an arbitrary war file...

Information Disclosure

Glassfish is vulnerable to information disclosure. This is because the MessageFormat parameters are not double single quote escaped e.g., ' '0' '...

Cross-site Scripting (XSS)

Glassfish admingui is vulnerable to cross-site scripting XSS attacks. The library does not escape user input in the configNameSection, making it vulnerable to XSS attacks...

Information Disclosure

Glassfish admingui is vulnerable to information disclosure attacks. These attacks are possible because Windows usernames and passwords are logged in plaintext in server.log...

Cross-site Scripting (XSS)

Glassfish is vulnerable to cross-site scripting XSS attacks. A malicious user can execute arbitrary script via the REST interface...

Denial Of Service (DoS)

Glassfish is vulnerable to denial of service DoS attacks. It does not properly handle the maximum number of items allowed in the range header of the servlet request, allowing denial of service attacks...

Denial Of Service (DoS)

Oracle Glassfish web-core is vulnerable to denial of service DoS attacks. The vulnerability exists because it allows the generation of the same hash value for all the values in the hash table, allowing it to cause hashtable collisions. Due to these hash table collisions, attackers can consume hou...

Oracle GlassFish Server 2.1.1.x < 2.1.1.30 / 3.0.1.x < 3.0.1.15 / 3.1.2.x < 3.1.2.16 Multiple Vulnerabilities (January 2017 CPU)

Binary data 9947.prm...

CVE-2017-3239

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration. Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server...

CVE-2017-3249

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Security. Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish...

CVE-2017-3249

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Security. Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish...

CVE-2017-3239

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration. Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server...

CVE-2017-3250

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Security. Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish...

CVE-2017-3247

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Core. Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish...

CVE-2017-3247

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Core. Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish...

Buffer overflow

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration. Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server...