Eclipse Glassfish at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 1 | 1 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 2 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 1 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 6 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
12 results · Feed
-
Critical 9.6
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfrest…
-
Medium 6.3
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line,…
-
Critical 9.1CVE-2026-2586 Public exploit
GlassFish's Administration Console is Vulnerable to RCE
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of t…
-
Critical 9.6CVE-2026-2587 Public exploit
GlassFish's gadget handler is vulnerable to RCE
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression…
-
Critical 9.1
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbi…
-
High 8.9
Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.
-
Medium 6.1
Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
-
Medium 5.8
Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications
In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.
-
Medium 4.5
Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console
In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.
-
Medium 6.1
Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
-
Medium 6.3
Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/s…
-
Medium 6.1
Eclipse Glassfish: URL redirection vulnerability to untrusted sites
In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects application…