Eclipse Jetty security vulnerabilities

Eclipse Jetty is an open source, Java-based web server and Java Servlet container from the Eclipse Foundation. A security vulnerability exists in Eclipse Jetty that originates from a remote denial-of-service attack that can be triggered by an unauthorized user by sending a carefully constructed...

jetty: stop accepting new connections from valid clients

A flaw was found in Jetty, a Java based web server and servlet engine. If an HTTP/2 connection gets TCP congested, it remains open and idle, and connections may be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file...

Moderate: Red Hat Security Advisory: Red Hat JBoss EAP 7.4.14 XP 4.0.2.GA security release

JBoss EAP XP 4.0.2.GA security release on the EAP 7.4.14 base is now available. See references for release notes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

RHEL 8 : Satellite 6.14.2 Async Security Update (Important) (RHSA-2024:0797)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0797 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

CData Connect Jetty Privilege Escalation

The vulnerability of the embedded Jetty server in the CData Connect integration, analysis, and data management platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges by sending specially...

CData Sync Jetty Unauthorized Access

The vulnerability in the embedded Jetty server of the CData Sync integration and replication tool is related to errors in processing the relative path to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected...

CData Arc Embedded Jetty Unauthorized Access

The vulnerability of the embedded Jetty server in the CData Arc ArcESB business process automation platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

CData API Server Privilege Escalation

The vulnerability in the embedded Jetty API server of the CData API Server is related to errors in processing the relative path to the directory, due to the lack of session verification for endpoints. Exploiting this vulnerability allows a malicious actor to increase their privileges by sending...

Security Misconfiguration org.eclipse.jetty:jetty-server Dependency in Crowd Data Center and Server

This High severity org.eclipse.jetty:jetty-server Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This org.eclipse.jetty:jetty-server Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-31850

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31851

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31851

CVE-2024-31851 – Path traversal in CData Sync (Java, embedded Jetty) Affected software: CData Sync Java edition prior to 23.4.8843 running with the embedded Jetty server. Vulnerability: Path traversal vulnerability allowing an unauthenticated remote attacker to access sensitive information and pe...

CVE-2024-31851

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31850

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31850

CVE-2024-31850 affects CData Arc prior to 23.4.8839 (Java version) running with embedded Jetty. A path traversal flaw can let an unauthenticated remote attacker access sensitive information and perform limited actions via crafted HTTP requests. Root cause described as errors in handling relative ...

CVE-2024-31848

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application...

CVE-2024-31849: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application...

CVE-2024-31850: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31848: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application...

CVE-2024-31851: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...