CVE-2009-4610

Multiple cross-site scripting XSS vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to jsp/dump.jsp in the JSP Dump feature, or the 2 Name or 3 Value parameter to the default URI for the Session Dump Servlet under...

CVE-2009-4612

Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...

CVE-2009-4612

Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...

CVE-2009-4611

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-4611

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-4609

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...

CVE-2009-4609

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable...

Design/Logic Flaw

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-4610

Multiple cross-site scripting XSS vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to jsp/dump.jsp in the JSP Dump feature, or the 2 Name or 3 Value parameter to the default URI for the Session Dump Servlet under...

Design/Logic Flaw

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable...

CVE-2009-4610

CVE-2009-4610 is a cross-site scripting (XSS) vulnerability in Mort Bay Jetty 6.x and 7.0.0, exploitable via the jsp/dump.jsp query string or the Name/Value parameters to the Session Dump Servlet under session/. The impact is remote script execution within the site’s context as described in the p...

CVE-2009-4612

Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...

CVE-2009-4611

CVE-2009-4611 affects Mort Bay Jetty 6.x through 6.1.22 and 7.0.0, where backtrace data is written without sanitizing non-printable characters. An attacker could abuse this to modify a window’s title or potentially execute arbitrary commands or overwrite files via HTTP requests containing termina...

CVE-2009-4611

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-4609

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable...

CVE-2009-4610

Multiple cross-site scripting XSS vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to jsp/dump.jsp in the JSP Dump feature, or the 2 Name or 3 Value parameter to the default URI for the Session Dump Servlet under...

CVE-2009-4612

CVE-2009-4612 refers to multiple cross-site scripting (XSS) flaws in Mort Bay Jetty 6.1.x (up to 6.1.21). An attacker could remotely exploit via PATH_INFO in the WebApp JSP Snoop page to inject scripts in a user’s browser, potentially compromising cookies and session data. Affected products in th...

CVE-2009-4609

Summary: CVE-2009-4609 affects Mort Bay Jetty 6.x/7.0.0, where the Dump Servlet contains an error that allows remote attackers to disclose internal data via a request to a URI ending in /dump/ (e.g., exposing getPathTranslated). Impact (as stated): leakage of sensitive internal variables and data...

Jetty CookieDump.java Sample Application Persistent XSS

The installed version of Mort Bay Jetty includes a sample web application, 'CookieDump.java', that allows for setting arbitrary cookies through user input to the 'Name' and 'Value' GET parameters to '/cookie' and in turn uses those without sanitizing them to generate dynamic HTML output. An...