GCVE - cpe:2.3:a:oracle:glassfish_server:2.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:oracle:glassfish_server:2.0:*:*:*:*:*:*:*

part: a version: 2.0 update: *

Vendor	Oracle (`3509f9eb-d8a0-57da-b153-b8021021b133`)
Product	Glassfish Server (`92636828-034c-5954-a937-360e645236cf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/javaee/glassfish`	purl2cpe	2026-06-01 10:18:14.683169

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-1554`	not_vulnerable	2026-06-08 04:51:23.948172	Details available Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise Server and other products, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 string in the PATH_INFO, which is displayed on the 404 error page, as demonstrated by the PATH_INFO to theme/META-INF. Published: 2009-05-06T16:00:00.000Z Updated: 2024-08-07T05:20:33.454Z Open on db.gcve.eu Reference links http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html http://www.securityfocus.com/bid/34829 http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html http://www.securityfocus.com/archive/1/503239/100/0/threaded http://secunia.com/advisories/35006	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5266`	vulnerable	2026-06-08 04:50:50.376501	Details available Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751. Published: 2008-11-28T18:26:00.000Z Updated: 2024-08-07T10:49:12.065Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/4659 http://www.securityfocus.com/archive/1/493243/100/0/threaded http://webappsecurity.wordpress.com/2008/06/11/xss-glassfish-web-admin-interface-sun-java-system-application/ https://exchange.xforce.ibmcloud.com/vulnerabilities/47029 http://secunia.com/advisories/30604	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2751`	vulnerable	2026-06-08 04:50:32.038428	Details available Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf. Published: 2008-06-18T19:29:00.000Z Updated: 2024-08-07T09:14:14.695Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/493370/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/42989 http://securityreason.com/securityalert/3949 http://www.securityfocus.com/bid/29751	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.