Oracle Glassfish Server vulnerabilities

40 CVEs affecting Oracle Glassfish Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3314, published 2021-06-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1000028, published 2017-07-17. High severity, CVSS 7.5. EPSS: 99.5% chance of exploitation in the next 30 days. Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP…
CVE-2011-5035, published 2011-12-30. Medium severity, CVSS 5.0. EPSS: 68.2% chance of exploitation in the next 30 days. Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters…
CVE-2011-0807, published 2011-04-20. High severity, CVSS 10.0. EPSS: 60.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity,…
CVE-2012-0551, published 2012-05-03. Medium severity, CVSS 5.8. EPSS: 11.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun…
CVE-2015-7182, published 2015-11-05. Critical severity, CVSS 9.8. EPSS: 10.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4…
CVE-2017-1000029, published 2017-07-17. High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days. Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability…
CVE-2015-3237, published 2015-06-22. Medium severity, CVSS 6.4. EPSS: 8.3% chance of exploitation in the next 30 days. The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and…
CVE-2009-1553, published 2009-05-06. Medium severity, CVSS 4.3. EPSS: 8.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to…
CVE-2016-3607, published 2016-07-21. Critical severity, CVSS 9.8. EPSS: 7.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2012-0550, published 2012-05-03. Medium severity, CVSS 6.8. EPSS: 6.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1 allows remote attackers to affect confidentiality, integrity, and…

Latest

CVE-2021-3314, published 2021-06-25. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is…
CVE-2018-3210, published 2018-10-17. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability…
CVE-2018-3152, published 2018-10-17. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). The supported version that is affected is 3.1.2. Easily exploitable vulnerability…
CVE-2018-2911, published 2018-10-17. High severity, CVSS 8.3. EPSS: 1.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability…
CVE-2018-14324, published 2018-07-16. Critical severity, CVSS 9.8. EPSS: 4.3% chance of exploitation in the next 30 days. The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially…
CVE-2017-10400, published 2017-10-19. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface). The supported version that is affected is 3.1.2. Easily…
CVE-2017-10393, published 2017-10-19. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable…
CVE-2017-10391, published 2017-10-19. High severity, CVSS 7.3. EPSS: 1.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable…
CVE-2017-10385, published 2017-10-19. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable…
CVE-2017-1000030, published 2017-07-17. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain…