Security Advisories

CVE-2024-8215

8.7

FIXED

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.

5.68.0, 4.1.2.191.51

CVE-2024-8097

6.7

FIXED

When the org.glassfish.admingui logger is set to the FINEST level, sensitive information can be exposed in log files.

5.67.0, 4.1.2.191.50

CVE-2024-7312

7.0

FIXED

REST Interface Link Redirection via Host parameter

5.67.0, 4.1.2.191.50

CVE-2021-29425

4.8

FIXED

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

4.1.2.191.49

CVE-2023-52428

-

FIXED

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component

5.64.0

CVE-2023-4043

7.5

FIXED

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

5.62.0, 4.1.2.191.48

CVE-2021-36374

5.5

FIXED

A specially crafted ZIP archive can cause an out of memory error

5.58.0, 4.1.2.191.47

CVE-2021-36373

5.5

FIXED

A specially crafted TAR archive can cause an out of memory error

5.58.0, 4.1.2.191.47

CVE-2020-1945

6.3

FIXED

Sensitive information may be leaked by the default temporary directory

5.58.0, 4.1.2.191.47

CVE-2023-41699

6.1

FIXED

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature on root context

5.57.0, 4.1.2.191.46

CVE-2023-1370

7.5

FIXED

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

5.56.0

CVE-2017-12617

8.1

FIXED

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

5.55.0, 4.1.2.191.45

CVE-2023-1370

7.5

FIXED

Json-smart is a library used by Payara Server for processing JSON in our implementations of MicroProfile. It was discovered that Json-smart does not limit the nesting of arrays or objects, the parsing of which is done recursively, and could lead to stack exhaustion and crash the software.

5.51.0

CVE-2022-0265

9.8

FIXED

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

CVE-2023-28462

9.8

N/A

JNDI Exploit using context.rebind method when running Payara Server on an older JDK 8 Update. The JNDI exploit can be triggered via access to insecure ORB listeners exposed by a Payara Server installation.

CVE-2022-1471

9.8

FIXED

SnakeYaml’s Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution

5.51.0

CVE-2022-2068

9.8

FIXED

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review.

5.47.0

CVE-2022-1292

9.8

FIXED

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.

5.47.0

CVE-2022-42920

9.8

FIXED

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected.

5.46.0

CVE-2022-45129

7.5

FIXED

A vulnerability exploit opens up to attackers a way to explore the contents of the WEB-INF and META-INF folders if an application is deployed to the root context.

5.45.0

CVE-2021-31684

N/A

FIXED

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

5.44.0

CVE-2022-37422

N/A

FIXED

Vulnerability exploit using ROOT context root deployments

5.42.0

CVE-2020-36518

7.5

FIXED

jackson-databind allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

5.38.0

CVE-2018-25032

7.5

FIXED

ZLib allows memory corruption when deflating (i.e. when compressing) if the input has many distant matches.

5.38.0

CVE-2022-22965

9.8

FIXED

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

5.38.0

CVE-2021-42392

N/A

N/A

Unauthenticated RCE in H2 Database Console

CVE-2021-40690

7.5

FIXED

The "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element, allowing abuse of an XPath Transform to extract any local .xml files in a RetrievalMethod element.

5.34.0

CVE-2018-10054

6.5

FIXED

Remote code execution vulnerability in H2 DB because CREATE ALIAS can execute arbitrary Java code

5.32.0

CVE-2018-14335

4.0

FIXED

Insecure handling of permissions in the backup function of the H2 DB

5.32.0

CVE-2021-41381

5.3

FIXED

Improper Limitation of a pathname to a restricted directory (exposes an application to "Path Traversal") when context root is /

5.31.0

CVE-2020-25649

7.5

FIXED

A flaw in FasterXML Jackson Databind 2.10.2 allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

5.30.0

CVE-2021-31684

7.5

FIXED

A vulnerability in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

5.30.0

CVE-2021-28170

5.3

FIXED

A bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid

5.29.0

CVE-2020-10693

5.3

FIXED

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls.

5.23.1

CVE-2019-17195

9.8

FIXED

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

5.21.2

CVE-2020-6950

7.5

FIXED

Eclipse Mojarra vulnerable to path trasversal flaw via either loc/con parameters

5.201

CVE-2019-12086

7.5

FIXED

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9

5.193, 5.192.1, 5.191.4

CVE-2018-14721

10.0

FIXED

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks

5.191, 5.184.1, 5.181.10, 4.1.2.191, 4.1.2.184.1, 4.1.2.181.10

CVE-2018-14720

9.8

FIXED

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct external XML entity (XXE) attacks

5.191, 5.184.1, 5.181.10, 4.1.2.191, 4.1.2.184.1, 4.1.2.181.10

CVE-2018-14719

9.8

FIXED

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code

5.191, 5.184.1, 5.181.10, 4.1.2.191, 4.1.2.184.1, 4.1.2.181.10

CVE-2018-14718

9.8

FIXED

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code

5.191, 5.184.1, 5.181.10, 4.1.2.191, 4.1.2.184.1, 4.1.2.181.10

CVE-2018-14371

7.5

FIXED

Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter.

5.191, 5.184.1, 5.181.10

CVE-2018-7489

9.8

FIXED

Default typing issue in Jackson Databind

4.1.2.181.3, 4.1.2.182, 5.181.3, 5.182

CVE-2017-12616

7.5

N/A

Apache Tomcat security constraint bypass and VirtualDirContext vulnerability

CVE-2017-12615

8.1

FIXED

Apache Tomcat vulnerability on Windows allowed for remote code execution via crafted PUT requests to JSPs

4.1.2.174

CVE-2016-1000031

9.8

FIXED

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

4.1.2.173

CVE-2017-3239

3.3

FIXED

Oracle GlassFish Server Local Security Vulnerability

4.1.2.173

CVE-2017-3247

4.3

FIXED

Oracle GlassFish Server Remote Security Vulnerability

4.1.2.173

CVE-2017-3249

7.3

FIXED

Oracle GlassFish Server Remote Security Vulnerability

4.1.2.173

CVE-2017-3250

7.3

FIXED

Oracle GlassFish Server Remote Security Vulnerability

4.1.2.173

CVE-2016-5528

9.0

FIXED

Oracle GlassFish Server Remote Security Vulnerability

4.1.2.173

CVE-2016-5519

8.8

N/A

Oracle GlassFish Server vulnerability in Oracle Fusion Middleware

CVE-2007-6726

N/A (V2: 4.3)

FIXED

XSS Vulnerabilities in Dojo libraries used for admin console

4.1.1.163

CVE-2012-2098

N/A (V2: 5.0)

FIXED

Apache Commons Compress bzip2 vulnerability allows DDoS attacks

4.1.1.163

CVE-2013-2035

N/A (V2: 4.4)

FIXED

Race condition in outdated jLine code allows arbitrary code execution

4.1.1.171

CVE-2014-0050

N/A (V2: 7.5)

FIXED

Apache Commons FileUpload allows DDoS attacks via crafted Content-Type headers

4.1.1.154.1

CVE-2015-0254

N/A (V2: 7.5)

N/A

Vulnerabilities on Apache JSTL allows arbitrary code injection

CVE-2015-3237

N/A (V2: 6.4)

N/A

Vulnerabilities in smb_request_state function in cURL

CVE-2015-5346

8.1

N/A

Apache Tomcat Vulnerability in session recycling for SSL requests

CVE-2015-5351

8.8

N/A

Apache Tomcat Manager Applications Session and CSRF token vulnerabilities

CVE-2016-0706

4.3

N/A

Apache Tomcat Vulnerability on StatusManagerServlet component allows reads of HTTP requests and discover session IDs

CVE-2016-0714

8.8

N/A

Session persistence in Apache Tomcat allows arbitrary code injection

CVE-2016-0763

6.3

FIXED

Vulnerability in ResourceLinkFactory.setGlobalContext method on Apache Tomcat

4.1.1.164.1

CVE-2016-3092

7.5

FIXED

Apache Commons FileUpload allows DDoS attacks via Multipart class

4.1.1.163

CVE-2016-3427

9.0

FIXED

Unspecified vulnerability in various versions of the Oracle JDK and JRockit

4.1.1.164.1

CVE-2016-3607

9.8

FIXED

Unspecified vulnerability on Oracle GlassFish 3.0+ affects confidentiality

4.1.1.163

CVE-2016-3608

5.8

N/A

Unspecified vulnerability on Oracle GlassFish 3.0.1 affects confidentiality

CVE-2016-5388

8.1

FIXED

Apache Tomcat does not protect applications from untrusted data when using the CGI Servlet

4.1.1.163.1

CVE-2016-5477

5.8

N/A

Unspecified vulnerability on Oracle GlassFish 3.0.1 affects confidentiality

CVE-2016-5519

8.8

N/A

Unspecified vulnerability on JSF implementation for Oracle Glassfish 3.0+

CVE-2016-6816

7.1

N/A

Apache Tomcat HTTP request parsing vulnerability allow injection of data into response

CVE-2017-1000028

7.5

FIXED

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.

4.1.1.161