SUSE: Security Advisory (SUSE-SU-2021:2005-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:2005-1 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: Update to version 9.4.42.v20210604 - Fix: bsc1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory - Fix: bsc1184367, CVE-2021-28165 - jet...

CVE-2021-28169

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...

CVE-2021-28169

creationtimestamp| type| source ---|---|--- 2021-06-09 08:55:00+00:00| seen| https://t.me/pwnwikizhchannel/625 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-28169.yaml...

UBUNTU-CVE-2021-28169

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...

CVE-2021-28169

CVE-2021-28169 affects Eclipse Jetty shipped with multiple versions (<= 9.4.40, <= 10.0.2,

Eclipse Jetty Information Disclosure Vulnerability (GHSA-gwcr-j4wh-j3cq)

Eclipse Jetty is prone to an information disclosure vulnerability in the ConcatServlet and WelcomeFilter servlet. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Eclipse Jetty 信息泄露漏洞（CVE-2021-28169）

...

Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission Vulnerability

Exploit Title: Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission Exploit Author: Adrian Bondocea Vendor Homepage: https://www.fluentd.org/ Software Link: https://td-agent-package-browser.herokuapp.com/4/windows Version: icacls C:\opt\td-agent\bin C:\opt\td-agent\bin...

Fluentd TD-agent 4.0.1 Insecure Folder Permission

Exploit Title: Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission Date: 21.12.2020 Exploit Author: Adrian Bondocea Vendor Homepage: https://www.fluentd.org/ Software Link: https://td-agent-package-browser.herokuapp.com/4/windows Version: icacls C:\opt\td-agent\bin C:\opt\td-agent\bin...

CVE-2020-28169

creationtimestamp| type| source ---|---|--- 2020-12-24 18:55:23+00:00| seen| https://t.me/cibsecurity/21272...

CVE-2020-28169

CVE-2020-28169 refers to the Fluentd td-agent-builder plugin vulnerability prior to 2020-12-18, where the bin directory is writable by a user and a file in bin can be executed with NT AUTHORITY\SYSTEM privileges, enabling local privilege escalation. Public exploit material and disclosures (e.g., ...