Search for packages
| purl | pkg:maven/org.eclipse.jetty/jetty-server@9.2.12.M0 |
| Next non-vulnerable version | 9.4.57.v20241219 |
| Latest non-vulnerable version | 12.0.9 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2r83-7d8z-aaaq
Aliases: CVE-2021-28165 GHSA-26vr-8j45-3r4w |
Uncontrolled Resource Consumption in Jetty |
Affected by 0 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-4pm7-acja-aaar
Aliases: CVE-2023-26049 GHSA-p26g-97m4-6q7c |
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-7uj6-vf93-aaaa
Aliases: CVE-2019-10241 GHSA-7vx9-xjhr-rw6h |
Cross-site Scripting in Eclipse Jetty |
Affected by 11 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 14 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-7wm2-db6q-aaad
Aliases: CVE-2023-36479 GHSA-3gh6-v5v9-6v9j |
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2. |
Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-7yc8-hgnk-aaam
Aliases: CVE-2021-34428 GHSA-m6cp-vxjx-65j6 |
SessionListener can prevent a session from being invalidated breaking logout |
Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-87rw-weuq-aaaq
Aliases: CVE-2023-40167 GHSA-hmr7-m48g-48f6 |
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. |
Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-9xa5-ja57-aaaa
Aliases: CVE-2020-27216 GHSA-g3wg-6mcf-8jj6 |
Local Temp Directory Hijacking Vulnerability |
Affected by 12 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-bawc-1w6m-aaag
Aliases: CVE-2018-12536 GHSA-9rgv-h7x4-qw8g |
Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server |
Affected by 10 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-fegk-bwmk-aaab
Aliases: CVE-2017-9735 GHSA-wfcc-pff6-rgc5 |
Exposure of Sensitive Information in org.eclipse.jetty:jetty-server |
Affected by 14 other vulnerabilities. Affected by 16 other vulnerabilities. Affected by 18 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-kxbc-px48-aaap
Aliases: CVE-2017-7657 GHSA-vgg8-72f2-qm23 |
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server |
Affected by 13 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-pqzz-su3f-aaae
Aliases: CVE-2017-7656 GHSA-84q7-p226-4x5w |
Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server |
Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-v2bf-23x6-aaah
Aliases: CVE-2019-10247 GHSA-xc67-hjx6-cgg6 |
Installation information leak in Eclipse Jetty |
Affected by 9 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-vz7f-5qd7-aaar
Aliases: CVE-2023-26048 GHSA-qw69-rqj8-6qw8 |
OutOfMemoryError for large multipart without filename in Eclipse Jetty |
Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-yrfy-a87q-aaar
Aliases: CVE-2019-10246 GHSA-r28m-g6j9-r2h5 |
Information Exposure vulnerability in Eclipse Jetty |
Affected by 9 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-z4nk-3d1m-aaab
Aliases: CVE-2017-7658 GHSA-6x9x-8qw9-9pp6 |
High severity vulnerability that affects org.eclipse.jetty:jetty-server |
Affected by 13 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 15 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||