deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-p9qm-p942-q3w5
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 1.0, < 16.10.6
Patched in: 16.10.6

Summary: XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Details:
### Impact

It's possible to execute any SQL query in Oracle by using the function like [DBMS_XMLGEN or DBMS_XMLQUERY](https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html).

The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).

### Patches

This has been patched in 16.10.6 and 17.3.0-rc-1.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### References

https://jira.xwiki.org/browse/XWIKI-22728

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
GitHub Security Advisory: GHSA-vr59-gm53-v7cq
Package: org.xwiki.platform:xwiki-platform-distribution-war (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 17.0.0-rc-1, < 17.3.0-rc-1
Patched in: 17.3.0-rc-1

Summary: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Details:
### Impact

It's possible for anyone to inject SQL using the parameter sort of the `getdeleteddocuments.vm`. It's injected as is as an ORDER BY value.

One can see the result of the injection with http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm&sort=injected (this example does not work, but it shows that an HQL query was executed with the passed value which look nothing like an order by value, without any kind of sanitation).

### Patches

This has been patched in 17.3.0-rc-1, 16.10.6.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### References

https://jira.xwiki.org/browse/XWIKI-23093

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

The vulnerability was identifier by Aleksey Solovev from Positive Technologies.
GitHub Security Advisory: GHSA-vr59-gm53-v7cq
Package: org.xwiki.platform:xwiki-platform-distribution-war (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 9.4-rc-1, < 16.10.6
Patched in: 16.10.6

Summary: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Details:
### Impact

It's possible for anyone to inject SQL using the parameter sort of the `getdeleteddocuments.vm`. It's injected as is as an ORDER BY value.

One can see the result of the injection with http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm&sort=injected (this example does not work, but it shows that an HQL query was executed with the passed value which look nothing like an order by value, without any kind of sanitation).

### Patches

This has been patched in 17.3.0-rc-1, 16.10.6.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### References

https://jira.xwiki.org/browse/XWIKI-23093

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

The vulnerability was identifier by Aleksey Solovev from Positive Technologies.
GitHub Security Advisory: GHSA-c23v-vqw5-52c5
Package: tech.powerjob:powerjob (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 4.3.9
Patched in: unpatched

Summary: PowerJob vulnerable to Incorrect Access Control via the create user/save interface.

Details:
PowerJob v4.9.3 is vulnerable to Incorrect Access Control via the create user/save interface.
GitHub Security Advisory: GHSA-xg9p-p463-3qjp
Package: org.apache.jena:jena (MAVEN)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 5.5.0
Patched in: 5.5.0

Summary: Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

Details:
File access paths in configuration files uploaded by users with administrator access are not validated.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.
GitHub Security Advisory: GHSA-jq2c-m8gg-mqcm
Package: org.apache.jena:jena-fuseki (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.5.0
Patched in: 5.5.0

Summary: Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Details:
Users with administrator access can create databases files outside the files area of the Fuseki server.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-f8vw-8vgh-22r9
Package: com.xuxueli:xxl-job-core (MAVEN)
Severity: LOW (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 3.1.1
Patched in: unpatched

Summary: XXL-JOB is vulnerable to SSRF attacks

Details:
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
GitHub Security Advisory: GHSA-83j7-mhw9-388w
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 26.3.1
Patched in: unpatched

Summary: Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-27gp-8389-hm4w. This link is maintained to preserve external references.

### Original Description
A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions (FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.
GitHub Security Advisory: GHSA-c352-x843-ggpq
Package: com.xuxueli:xxl-job (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.4.2
Patched in: unpatched

Summary: XXL-JOB vulnerable to Server-Side Request Forgery

Details:
xxl-job <= 2.4.2 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
GitHub Security Advisory: GHSA-g5cj-5h58-j93w
Package: org.jeecgframework.boot:jeecg-module-system (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Jeecg-boot vulnerable to SQL Injection

Details:
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
GitHub Security Advisory: GHSA-v87q-rpwp-qr7q
Package: org.jeecgframework.boot:jeecg-module-system (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Jeecg-boot vulnerable to SQL Injection

Details:
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.
GitHub Security Advisory: GHSA-4j2x-v3mr-467m
Package: org.jeecgframework.boot:jeecg-module-system (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString

Details:
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
GitHub Security Advisory: GHSA-25gv-mvm7-5h3h
Package: org.jeecgframework.boot:jeecg-module-system (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin

Details:
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
GitHub Security Advisory: GHSA-2m53-83f3-562j
Package: org.webjars.npm:min-dash (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 3.8.1
Patched in: 3.8.1

Summary: Prototype pollution in min-dash

Details:
### Impact

The `set` method is vulnerable to prototype pollution with specially crafted inputs.

```javascript
// insert the following into poc.js and run node poc,js (after installing the package)
 
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
```

### Patches

`min-dash>=3.8.1` fix the issue.

### Workarounds

No workarounds exist for the issue.

### References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

### Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.
GitHub Security Advisory: GHSA-8gqf-26xw-x3gx
Package: com.liferay:com.liferay.login.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.1.20
Patched in: 1.1.20

Summary: Liferay Portal XSS Vulnerability 

Details:
Cross-site scripting (XSS) exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
GitHub Security Advisory: GHSA-8gqf-26xw-x3gx
Package: com.liferay:com.liferay.login.authentication.openid.connect.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0
Patched in: 1.0.1

Summary: Liferay Portal XSS Vulnerability 

Details:
Cross-site scripting (XSS) exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
GitHub Security Advisory: GHSA-8gqf-26xw-x3gx
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.3-GA4
Patched in: 7.0.3-GA4

Summary: Liferay Portal XSS Vulnerability 

Details:
Cross-site scripting (XSS) exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
GitHub Security Advisory: GHSA-cm99-x97g-9qx8
Package: com.liferay:com.liferay.frontend.taglib (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.1.3
Patched in: 2.1.3

Summary: Liferay Portal XSS Vulnerability

Details:
XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
GitHub Security Advisory: GHSA-cm99-x97g-9qx8
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.3-GA4
Patched in: 7.0.3-GA4

Summary: Liferay Portal XSS Vulnerability

Details:
XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
GitHub Security Advisory: GHSA-w7f2-6896-6mm2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp8
Patched in: 7.2.10.fp8

Summary: Liferay Portal and Liferay DXP allows arbitrary injection via web content template names

Details:
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
GitHub Security Advisory: GHSA-w7f2-6896-6mm2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp19
Patched in: 7.1.10.fp19

Summary: Liferay Portal and Liferay DXP allows arbitrary injection via web content template names

Details:
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
GitHub Security Advisory: GHSA-w7f2-6896-6mm2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, < 7.0.10.fp94
Patched in: 7.0.10.fp94

Summary: Liferay Portal and Liferay DXP allows arbitrary injection via web content template names

Details:
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
GitHub Security Advisory: GHSA-w7f2-6896-6mm2
Package: com.liferay:com.liferay.journal.content.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.15
Patched in: 5.0.15

Summary: Liferay Portal and Liferay DXP allows arbitrary injection via web content template names

Details:
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
GitHub Security Advisory: GHSA-7r3w-wggm-pjwf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp15
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module

Details:
In Search Web before v6.0.19 in Liferay Portal (v7.1.0 through v7.4.2) and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
GitHub Security Advisory: GHSA-7r3w-wggm-pjwf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp26
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module

Details:
In Search Web before v6.0.19 in Liferay Portal (v7.1.0 through v7.4.2) and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
GitHub Security Advisory: GHSA-7r3w-wggm-pjwf
Package: com.liferay:com.liferay.portal.search.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.19
Patched in: 6.0.19

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module

Details:
In Search Web before v6.0.19 in Liferay Portal (v7.1.0 through v7.4.2) and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
GitHub Security Advisory: GHSA-4gr7-qw2q-jxh6
Package: com.alibaba.nacos:nacos-common (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.5
Patched in: 1.4.5

Summary: Cross-site Scripting in Nacos

Details:
A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.
GitHub Security Advisory: GHSA-4gr7-qw2q-jxh6
Package: com.alibaba.nacos:nacos-common (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0-ALPHA.1, < 2.1.0-BETA
Patched in: 2.1.0-BETA

Summary: Cross-site Scripting in Nacos

Details:
A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.
GitHub Security Advisory: GHSA-83w4-x5w9-hf4h
Package: com.xuxueli:xxl-job-core (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2.4.0
Patched in: 2.4.0

Summary: XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

Details:
XXL-Job before v2.4.0 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
GitHub Security Advisory: GHSA-c6mx-3fj9-9j7q
Package: tech.powerjob:powerjob (MAVEN)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: <= 4.3.6
Patched in: unpatched

Summary: PowerJob vulnerable to incorrect access control

Details:
PowerJob v4.3.6 is vulnerable to Incorrect Access Control that allows for remote code execution.
GitHub Security Advisory: GHSA-mpvf-6h9g-2hq2
Package: tech.powerjob:powerjob (MAVEN)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: <= 4.3.6
Patched in: unpatched

Summary: PowerJob Incorrect Access Control vulnerability

Details:
PowerJob v4.3.6 is vulnerable to Incorrect Access Control via the create app interface.
GitHub Security Advisory: GHSA-f7h5-c625-3795
Package: org.glassfish.main.admingui:console-common (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 6.2.5
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

Details:
In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.
GitHub Security Advisory: GHSA-mqxx-c43h-jj9v
Package: org.glassfish.main.admingui:console-common (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

Details:
In Eclipse GlassFish version 7.0.15, it is possible to perform Stored Cross-Site Scripting attacks through the Administration Console.
GitHub Security Advisory: GHSA-99f7-hp6j-v6q4
Package: org.glassfish.main.admingui:console-common (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

Details:
In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.
GitHub Security Advisory: GHSA-62g9-99m7-w8wv
Package: org.glassfish.main.admingui:console-cluster-plugin (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

Details:
In Eclipse GlassFish version 7.0.15, it is possible to perform Stored Cross-Site Scripting attacks through the Administration Console.
GitHub Security Advisory: GHSA-hp97-5x6g-q538
Package: org.glassfish.main.admingui:console-common (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

Details:
In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.
GitHub Security Advisory: GHSA-vqrm-83g6-pfv4
Package: org.glassfish.main.admingui:console-cluster-plugin (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console

Details:
In Eclipse GlassFish version 7.0.15, it is possible to perform Reflected Cross-Site Scripting attacks through the Administration Console.
GitHub Security Advisory: GHSA-vqrm-83g6-pfv4
Package: org.glassfish.main.admingui:console-common (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.0.25
Patched in: unpatched

Summary: Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console

Details:
In Eclipse GlassFish version 7.0.15, it is possible to perform Reflected Cross-Site Scripting attacks through the Administration Console.