Search for packages
| purl | pkg:maven/org.eclipse.jetty/jetty-server@9.3.1.v20150714 |
| Next non-vulnerable version | 10.0.0.beta3 |
| Latest non-vulnerable version | 12.1.10 |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2017-7658
|
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-4800
|
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-7656
|
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6x9x-8qw9-9pp6
Aliases: CVE-2017-7658 |
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) Eclipse Jetty Server versions 9.2.x and … |
Vulnerable |
|
GHSA-26vr-8j45-3r4w
Aliases: CVE-2021-28165 |
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources ### Impact When using SSL/TLS with Jetty, … | There are no reported fixed by versions. |
|
GHSA-p26g-97m4-6q7c
Aliases: CVE-2023-26049 |
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies Nonstandard cookie parsing in Jetty may allow … |
Vulnerable |
|
GHSA-qw69-rqj8-6qw8
Aliases: CVE-2023-26048 |
OutOfMemoryError for large multipart without filename in Eclipse Jetty ### Impact Servlets with multipart support (e.g. annotated with `@MultipartConfig`) that … |
Vulnerable |
|
CVE-2019-10247
|
Information Exposure In Eclipse Jetty, the server running on any OS and Jetty version combination will reveal the configured fully … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-34428
Aliases: GHSA-m6cp-vxjx-65j6 |
Insufficient Session Expiration If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-10241
|
Cross-Site Scripting Eclipse Jetty server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2023-26049
Aliases: GHSA-p26g-97m4-6q7c |
Exposure of Sensitive Information to an Unauthorized Actor Jetty is a java based web server and servlet engine. Nonstandard cookie … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-40167
Aliases: GHSA-hmr7-m48g-48f6 |
Improper Handling of Length Parameter Inconsistency Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-28165
Aliases: GHSA-26vr-8j45-3r4w |
Uncontrolled Resource Consumption In Eclipse Jetty to alpha0 to alpha0 to, CPU usage can reach % upon receiving a large … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-27216
|
Creation of Temporary File in Directory with Insecure Permissions In Eclipse Jetty on Unix like systems, the system's temporary directory … |
Vulnerable Not vulnerable Not vulnerable |
|
GHSA-872g-2h8h-362q
Aliases: CVE-2016-4800 |
Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request The path normalization … | There are no reported fixed by versions. |
|
CVE-2017-7658
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) If an intermediary decided on the shorter length, but still passed on … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-7656
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Eclipse Jetty contains a vulnerability that could be used to poison the … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-12536
|
Information Exposure When an intentionally bad query arrives that does not match a dynamic url-pattern, and is eventually handled by … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-9rgv-h7x4-qw8g
Aliases: CVE-2018-12536 |
Eclipse Jetty Server generates error message containing sensitive information In Eclipse Jetty Server, all 9.x versions, on webapps deployed using … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-vgg8-72f2-qm23
Aliases: CVE-2017-7657 |
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The … |
Vulnerable Vulnerable |
|
GHSA-wfcc-pff6-rgc5
Aliases: CVE-2017-9735 |
Jetty vulnerable to exposure of sensitive information due to observable discrepancy Jetty through 9.4.x contains a timing channel attack in … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-84q7-p226-4x5w
Aliases: CVE-2017-7656 |
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling) Eclipse Jetty, versions 9.2.x and older, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-m6cp-vxjx-65j6
Aliases: CVE-2021-34428 |
SessionListener can prevent a session from being invalidated breaking logout ### Impact If an exception is thrown from the `SessionListener#sessionDestroyed()` … |
Vulnerable Vulnerable |
|
GHSA-xc67-hjx6-cgg6
Aliases: CVE-2019-10247 |
Installation information leak in Eclipse Jetty In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-7vx9-xjhr-rw6h
Aliases: CVE-2019-10241 |
Cross-site Scripting in Eclipse Jetty In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-r28m-g6j9-r2h5
Aliases: CVE-2019-10246 |
Information Exposure vulnerability in Eclipse Jetty In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-h2f4-v4c4-6wx4
Aliases: CVE-2018-12545 |
Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service … |
Vulnerable Vulnerable Vulnerable |