Multiple security vulnerabilities in the HTTP Engine and the Administration Interface of the Sun GlassFish Enterprise Server may:

1. Allow a remote unprivileged user to execute JavaScript within an authenticated user's browser session. These vulnerabilities may lead to various impacts, including theft of sensitive information (such as cookie information), access to user credentials, or the hijacking of sessions.

2. Allow a local privileged user to consume excessive system resources, thereby leading to Denial of Service (DoS) to the system as a whole.

Sun acknowledges with thanks, Digital Security Research Group for bringing the issue described in Bug 6820994 to our attention.