CVE-2007-5613: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

Mortbay Jetty Dump Servlet vulnerable to cross-site scripting

Overview The Mortbay Jetty Dump Servlet contains a cross-site scripting vulnerability. Description Mortbay Jetty is a web server that is written in Java. The Dump Servlet that is included with Jetty is vulnerable to cross-site scripting. Note that according to the vendor, the Dump Servlet is for...

Mortbay Jetty fails to properly handle cookies with quotes

Overview Mortbay Jetty fails to properly handle cookie quotes, which may allow session hijacking. Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle cookies with certain quote sequences. This can cause the Jetty cookie parsing mechanism to improperly...

Mortbay Jetty vulnerable to HTTP response splitting

Overview Mortbay Jetty is vulnerable to HTTP response splitting, which may allow a remote, unauthenticated attacker to inject various HTTP headers Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle HTTP headers with CRLF sequences, which can allow an...

Jetty < 6.1.6 Multiple Vulnerabilities

Binary data 4307.prm...

CVE-2006-6969

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

CVE-2006-6969

Jetty (versions: before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, 6.1 before 6.1.0pre3) uses java.util.Random to generate session IDs. This leads to predictable session identifiers that remote attackers could brute-force to guess sessions, potentially bypass authentication and enable cross-sit...

CVE-2006-6969

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

Jetty可预测随机会话ID漏洞

Jetty是一款流行的Java Web服务器。 Jetty的会话ID随机生成实现上存在漏洞，远程攻击者可能利用此漏洞获取非授权访问。 Jetty使用java.util.Random生成会话ID。java.util.random实现以下形式的线性同余随机数生成器： synchronized protected int nextint bits seed = seed 0x5DEECE66DL + 0xBL & 1L 48 - 1; return intseed 48 - bits;...

CVE-2006-6969: Undefined Security Weakness

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

Jetty Non-random Session ID Vulnerability

Binary data 3904.prm...

Jetty web server weak pseudo-random number generator

Weak PRNG generator is used for session cookie making it's possible to spoof the session id...

Jetty Session ID Prediction

======= Summary ======= Name: Jetty Session Id Prediction Release Date: 5 February 2007 Reference: NGS00471 Discover: Chris Anley [email protected] Vendor: Mortbay Systems Affected: Jetty prior to versions 4.2.27, 5.1.12, 6.0.2 and 6.1.0pre3 Risk: High Status: Fixed ======== TimeLine ========...

[CAID 34661]: CA Unicenter WSDM File System Read Access Vulnerability

Title: CAID 34661: CA Unicenter WSDM File System Read Access Vulnerability CA Vulnerability ID CAID: 34661 CA Advisory Date: 2006-10-03 Discovered By: Oliver Karow, Symantec Security Consultant oliverkarow at symantec dot com Richard Sammet, Symantec Security Consultant richardsammet at symantec...

Jetty directory traversal

Directory traversal on CGI apllications access...

Code injection

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

CVE-2006-2759

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...

Directory traversal

Directory traversal vulnerability in jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c encoded ../ in the URL. NOTE: this might be the same issue as CVE-2005-3747...

CVE-2006-2758

Directory traversal vulnerability in jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c encoded ../ in the URL. NOTE: this might be the same issue as CVE-2005-3747...

CVE-2006-2759

jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations...