Oracle Glassfish Server — known CVE vulnerabilities

Every CVE whose affected-product data names Oracle Glassfish Server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (40)

• CVE-2011-0807 — CVSS 10.0 (critical): Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1…
• CVE-2017-1000030 — CVSS 9.8 (critical): Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes…
• CVE-2015-7182 — CVSS 9.8 (critical): Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as…
• CVE-2018-14324 — CVSS 9.8 (critical): The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin…
• CVE-2016-3607 — CVSS 9.8 (critical): Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to…
• CVE-2016-5528 — CVSS 9.0 (critical): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are…
• CVE-2016-5519 — CVSS 8.8 (high): Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote…
• CVE-2016-1950 — CVSS 8.8 (high): Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in…
• CVE-2018-2911 — CVSS 8.3 (high): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version…
• CVE-2011-3559 — CVSS 7.8 (high): Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App…
• CVE-2017-1000029 — CVSS 7.5 (high): Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible…
• CVE-2017-1000028 — CVSS 7.5 (high): Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability…
• CVE-2018-3152 — CVSS 7.5 (high): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). The supported version…
• CVE-2017-3249 — CVSS 7.3 (high): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are…
• CVE-2017-3250 — CVSS 7.3 (high): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are…
• CVE-2017-10391 — CVSS 7.3 (high): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that…
• CVE-2012-0550 — CVSS 6.8 (medium): Unspecified vulnerability in the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1…
• CVE-2015-3237 — CVSS 6.4 (medium): The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from…
• CVE-2017-10393 — CVSS 6.3 (medium): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that…
• CVE-2017-10385 — CVSS 6.3 (medium): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that…
• CVE-2021-3314 — CVSS 6.1 (medium): Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to…
• CVE-2016-5477 — CVSS 5.8 (medium): Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1 and 3.0.1 allows remote attackers to…
• CVE-2012-0551 — CVSS 5.8 (medium): Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and…
• CVE-2016-3608 — CVSS 5.8 (medium): Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 allows remote attackers to affect…
• CVE-2010-4438 — CVSS 5.7 (medium): Unspecified vulnerability in Oracle GlassFish 2.1, 2.1.1, and 3.0.1, and Java System Message Queue 4.1 allows local users to affect…
• CVE-2017-10400 — CVSS 5.4 (medium): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface)…
• CVE-2018-3210 — CVSS 5.3 (medium): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version…
• CVE-2012-3155 — CVSS 5.0 (medium): Unspecified vulnerability in the CORBA ORB component in Sun GlassFish Enterprise Server 2.1.1, Oracle GlassFish Server 3.0.1 and 3.1.2, and…
• CVE-2011-5035 — CVSS 5.0 (medium): Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and…
• CVE-2012-0104 — CVSS 5.0 (medium): Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect availability via unknown…
• CVE-2008-2751 — CVSS 4.3 (medium): Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow…
• CVE-2013-1620 — CVSS 4.3 (medium): The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant…
• CVE-2013-1508 — CVSS 4.3 (medium): Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Middleware Products 3.0.1 and 3.1.2 allows remote…
• CVE-2017-3247 — CVSS 4.3 (medium): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are…
• CVE-2009-1553 — CVSS 4.3 (medium): Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to…
• CVE-2008-5266 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java…
• CVE-2012-0081 — CVSS 3.7 (low): Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.1.1 allows local users to affect confidentiality, integrity, and…
• CVE-2017-3239 — CVSS 3.3 (low): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that…
• CVE-2017-3626 — CVSS 3.1 (low): Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version…
• CVE-2010-2397 — CVSS 2.4 (low): Unspecified vulnerability in Oracle Sun Java System Application Server 8.0, 8.1, and 8.2; and GlassFish Enterprise Server 2.1.1; allows…