eclipse-ee4j/glassfish

eclipse-ee4j/glassfish

Releases93

Frequency1 month 5 hours

Last Release 11 days ago

Stars444

Eclipse GlassFish

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-9329 ↗	Sep 30, 2024Monday, 30 September 2024, 08:15	6.1 MEDIUM	—
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVE-2024-8646 ↗	Sep 11, 2024Wednesday, 11 September 2024, 14:15	6.1 MEDIUM	—
In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').
CVE-2018-14324 ↗	Jul 16, 2018Monday, 16 July 2018, 18:29	—	10 HIGH
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOTE: this is not an Oracle supported product.