CVE-2009-1553

Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.

• CWE-79

• http://dsecrg.com/pages/vul/show.php?id=134Exploit
• http://jvn.jp/en/jp/JVN73653977/index.html
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
• http://osvdb.org/54249
• http://osvdb.org/54250
• http://osvdb.org/54251
• http://osvdb.org/54252
• http://osvdb.org/54253
• http://osvdb.org/54254
• http://osvdb.org/54255
• http://osvdb.org/54256
• http://osvdb.org/54257
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
• http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
• http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
• http://www.securityfocus.com/archive/1/503236/100/0/threaded
• http://www.securityfocus.com/bid/34824Exploit
• http://www.securityfocus.com/bid/34914
• http://www.vupen.com/english/advisories/2009/1255
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668Patch, Vendor Advisory
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669Patch, Vendor Advisory
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675Patch, Vendor Advisory
• http://dsecrg.com/pages/vul/show.php?id=134Exploit
• http://jvn.jp/en/jp/JVN73653977/index.html
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
• http://osvdb.org/54249
• http://osvdb.org/54250
• http://osvdb.org/54251
• http://osvdb.org/54252
• http://osvdb.org/54253
• http://osvdb.org/54254
• http://osvdb.org/54255
• http://osvdb.org/54256
• http://osvdb.org/54257
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
• http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
• http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
• http://www.securityfocus.com/archive/1/503236/100/0/threaded
• http://www.securityfocus.com/bid/34824Exploit
• http://www.securityfocus.com/bid/34914
• http://www.vupen.com/english/advisories/2009/1255
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668Patch, Vendor Advisory
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669Patch, Vendor Advisory
• https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675Patch, Vendor Advisory

Published

May 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1547Unspecified vulnerability in Microsoft Internet Explorer 5.0…8.8
• CVE-2009-1548SQL injection vulnerability in index.php in BluSky CMS allow…
• CVE-2009-1549AGTC MyShop 3.2b allows remote attackers to bypass authentic…
• CVE-2009-1550Zakkis Technology ABC Advertise 1.0 does not properly restri…
• CVE-2009-1551Multiple PHP remote file inclusion vulnerabilities in Qt qui…
• CVE-2009-1552Unspecified vulnerability in the IGMP driver in SCO Unixware…
• CVE-2009-1554Cross-site scripting (XSS) vulnerability in ThemeServlet.jav…
• CVE-2009-1555The Cisco Linksys WVC54GCA wireless video camera with firmwa…
• CVE-2009-1556img/main.cgi on the Cisco Linksys WVC54GCA wireless video ca…
• CVE-2009-1557Multiple cross-site scripting (XSS) vulnerabilities on the C…
• CVE-2009-1558Directory traversal vulnerability in adm/file.cgi on the Cis…
• CVE-2009-1559Absolute path traversal vulnerability in adm/file.cgi on the…