10 matches found
VulnCheck KEV: CVE-2020-9314
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...
org.glassfish.main.admingui:console-cluster-plugin (>=3.1.2, <=9.0.0-m3), org.glassfish.main.admingui:console-commandrecorder-plugin (>=7.0.16, <=9.0.0-m3) +16 more potentially affected by CVE-2024-10031 via org.glassfish.main.admingui:console-common (>=3.1.2, <=9.0.0-m3)
org.glassfish.main.admingui:console-common MAVEN version =3.1.2, =3.1.2, =7.0.16, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =4.0-b72, =7.1.1, =3.1.2, =4.0-b72, =3.1.2, =4.0-b90, =4.0-b90, =6.2.5, =9.0.0-m3 and more Source cves: CVE-2024-10031 Source advisory:...
CVE-2020-9315
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...
CVE-2020-9315
Oracle iPlanet Web Server 7.0.x is affected by two CVEs. CVE-2020-9315: authentication bypass via incorrect access control on admingui/version URIs, enabling unauthenticated read access to encryption keys. CVE-2020-9314: image injection via productNameSrc in the admingui, stemming from an incompl...
CVE-2020-9314: Improper Neutralization of Input During Web Page Generation
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...
PT-2020-5388
Name of the Vulnerable Software and Affected Versions Oracle iPlanet Web Server version 7.0.x Description The issue is related to incorrect access control in the Oracle iPlanet Web Server, allowing unauthenticated read access to encryption keys. This can enable a remote attacker to disclose...
CVE-2020-9315: Missing Authentication for Critical Function
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...
PT-2020-5394
Name of the Vulnerable Software and Affected Versions Oracle iPlanet Web Server versions 7.0.x Description The issue exists due to an incomplete fix, allowing an attacker to inject images into the administration console. This can be achieved through the productNameSrc parameter in the admingui UR...
Cross-site Scripting (XSS)
Glassfish admingui is vulnerable to cross-site scripting XSS attacks. The library does not escape user input in the configNameSection, making it vulnerable to XSS attacks...