58 matches found
Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty.
Summary There are multiple vulnerabilities in Jetty Server. Sterling Connect:Direct Browser User Interface has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the...
SUSE SLED15: jetty-annotations / jetty-ant / jetty-cdi / jetty-client / etc (SUSE-SU-2023:2539-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2539-1 advisory. Updated to version 9.4.51.v20230217: - CVE-2023-26048: Fixed an excessive memory consumption whe...
Eclipse Jetty Multiple Vulnerabilities (GHSA-qw69-rqj8-6qw8, GHSA-p26g-97m4-6q7c) - Linux
Eclipse Jetty is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty"; ifdescription...
CVE-2023-26049
creationtimestamp| type| source ---|---|--- 2023-04-19 00:29:39+00:00| seen| https://t.me/cibsecurity/62395 2024-01-28 02:15:54+00:00| seen| https://t.me/arpsyndicate/3162 2024-03-20 05:07:42+00:00| seen| https://t.me/CyberSecurityTechnologies/9503 2024-08-16 08:55:30+00:00| seen|...
CVE-2023-26049
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...
CVE-2023-26049 vulnerabilities
Vulnerabilities for packages: cassandra-reaper...
CVE-2023-26049 vulnerabilities
Vulnerabilities for packages: cassandra-reaper...
CVE-2023-26049
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...
CVE-2023-26049 Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...
CVE-2023-26049 Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...
CVE-2023-26049
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...
CVE-2023-26049
Jetty cookie parsing vulnerability CVE-2023-26049 affects Jetty’s cookie handling where a cookie VALUE starting with a double quote can cause the parser to read past semicolons, effectively merging multiple cookies into one. This can enable cookie smuggling (e.g., exfiltrating HttpOnly cookies li...
CVE-2022-26049
CVE-2022-26049 affects com.diffplug.gradle:goomph before 3.37.2. The unzip path handling permits writing files to arbitrary locations on the filesystem, potentially enabling remote code execution. Affected versions lack sufficient path validation in ZipMisc.java; the only file extracted is the p2...
CVE-2022-26049 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve...
CVE-2021-26049
CVE-2021-26049 is rejected/not used; this CVE entry does not represent an active vulnerability.
CVE-2020-26049
Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...
CVE-2020-26049
CVE-2020-26049 affects Nifty-PM CPE 2.3 and is due to stored HTML injection in a component/feature, enabling remote arbitrary code execution as described in the CVE overview. The connected Red Hat advisory and NVD entries corroborate the impact as remote code execution via stored HTML injection. ...