org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)

org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...

com.yammer.dropwizard:dropwizard-client (0.1.1), com.yammer.dropwizard:dropwizard-core (0.1.1) +50 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.1 - com.yammer.dropwizard:dropwizard-core 0.1.1 -...

com.yammer.dropwizard:dropwizard-client (0.1.2), com.yammer.dropwizard:dropwizard-core (0.1.2) +51 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.0.rc3)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.2 - com.yammer.dropwizard:dropwizard-core 0.1.2 -...

com.hmsonline:hms-cassandra-rest (>=0.15.0, <=1.0.0), com.hmsonline:virgil (>=0.16.0, <=1.0.1) +53 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hmsonline:hms-cassandra-rest =0.15.0, =0.16.0, =1.0.1 -...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

com.datastax.spark:spark-cassandra-connector-demos_2.10 (>=1.0.0-rc3, <=1.0.6), com.datastax.spark:spark-cassandra-connector-java_2.10 (>=1.0.0-rc3, <=1.0.6) +111 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.8.v20121106)

org.eclipse.jetty:jetty-server MAVEN version 7.6.8.v20121106 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.datastax.spark:spark-cassandra-connector-demos2.10 =1.0.0-rc3, =1.0.0-rc3,...

com.alibaba.jvm.sandbox:sandbox-core (1.0.0), com.cueup.hegemon:hegemon-testserver (>=0.0.1, <=0.0.2) +322 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (>=8.0.0.m0, <=8.1.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version =8.0.0.m0, =0.0.1, =3.4, =0.7.0-p1, =1.3.4, =1.1.11, =1.0, =1.0, =1.4, =2.1, =1.4, =2.1, =1.0, =1.5 and more Source cves: CVE-2011-4461 Source advisory: GHSA-QXP4-27VX-XMM3...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.apache.felix:org.apache.felix.http.bundle (2.2.2), org.apache.felix:org.apache.felix.http.jetty (2.2.2) +52 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.13.v20130916)

org.eclipse.jetty:jetty-server MAVEN version 7.6.13.v20130916 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.2 -...

br.com.arsmachina:tapestry-url-rewriter (>=1.0.1, <=2.0.0), org.apache.geronimo.assemblies:geronimo-jetty7-javaee5 (2.2) +93 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.0.0.v20091005)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.v20091005 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - br.com.arsmachina:tapestry-url-rewriter =1.0.1, =2.0.0 -...

Eclipse Jetty HTTP Request Smuggling

The vulnerability of the Hypertext Transfer Protocol HTTP/1.1 implementation in Eclipse Jetty servers is related to deficiencies in handling the Transfer-Encoding and Content-Length headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTT...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

jetty: buffer not correctly recycled in Gzip Request inflation

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that ...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

jetty: SessionListener can prevent a session from being invalidated breaking logout

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

Jetty 11.0.x < 11.0.6 Information Disclosure

The version of Jetty installed on the remote host has a flaw which allows bypass of security constraints and access protected resources. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Jetty 9.4.6 < 9.4.37 Denial of Service

The version of Jetty installed on the remote host handles a request containing request headers with a large number of quality i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage. Note that the scanner has not tested for this issue but has instead relied onl...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

jetty: Resource exhaustion when receiving an invalid large TLS frame

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...

jetty: Resource exhaustion when receiving an invalid large TLS frame

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...