org.apache.camel:camel-example-cxf (1.6.1), org.apache.camel:camel-jetty (1.6.1) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.6.1)

org.apache.camel:camel-http MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-example-cxf 1.6.1 - org.apache.camel:camel-jetty 1.6.1 Source cves: CVE-2015-5348...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

org.apache.activemq:apache-activemq (5.2.0), org.apache.camel:camel-example-cxf (1.5.0) +1 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.5.0)

org.apache.camel:camel-http MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.activemq:apache-activemq 5.2.0 - org.apache.camel:camel-example-cxf 1.5.0 -...

org.apache.camel:camel-example-cxf (1.6.3) potentially affected by CVE-2015-5348 via org.apache.camel:camel-jetty (1.6.3)

org.apache.camel:camel-jetty MAVEN version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jetty and may be impacted: - org.apache.camel:camel-example-cxf 1.6.3 Source cves: CVE-2015-5348 Source advisory:...

org.apache.camel:camel-example-cxf (1.4.0), org.apache.camel:camel-jetty (1.4.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.4.0)

org.apache.camel:camel-http MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-example-cxf 1.4.0 - org.apache.camel:camel-jetty 1.4.0 Source cves: CVE-2015-5348...

org.apache.camel:camel-example-cxf (1.6.4) potentially affected by CVE-2015-5348 via org.apache.camel:camel-jetty (1.6.4)

org.apache.camel:camel-jetty MAVEN version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jetty and may be impacted: - org.apache.camel:camel-example-cxf 1.6.4 Source cves: CVE-2015-5348 Source advisory:...

Security Bulletin: Vulnerabilities in Eclipse Jetty affect the IBM InfoSphere Information Server installers

Summary Vulnerabilities in Eclipse Jetty was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-7658 DESCRIPTION: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a...

Access and integrity issue within Eclipse Jetty

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), br.com.thiaguten:umbrella-monitoring (>=0.1.0, <=1.0.0) +1235 more potentially affected by CVE-2018-12538 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.10.v20180503)

org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =0.1.0, =0.0.1, =1.1, =1.1, =1.1, =0.9.1, =0.0.5, =0.0.5, =0.0.5, =0.0.7 - cn.spring-up:spring-co 0.1 - cn.spring-up:spring-import 0.1 and more Source cves: CVE-2018-12538 Source advisory: OSV:GHSA-MWCX-532G-8PQ3...

GHSA-MWCX-532G-8PQ3 Access and integrity issue within Eclipse Jetty

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), br.com.thiaguten:umbrella-monitoring (>=0.1.0, <=1.0.0) +1235 more potentially affected by CVE-2018-12538 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.10.v20180503)

org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =0.1.0, =0.0.1, =1.1, =1.1, =1.1, =0.9.1, =0.0.5, =0.0.5, =0.0.5, =0.0.7 - cn.spring-up:spring-co 0.1 - cn.spring-up:spring-import 0.1 and more Source cves: CVE-2018-12538 Source advisory: GHSA-MWCX-532G-8PQ3...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

Directory traversal

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

CVE-2018-17605 affects the Asset Pipeline plugin for Grails (versions before 3.0.4). A directory traversal flaw exists when a servlet-based application runs in Jetty, due to a classloader vulnerability that enables a reverse file traversal path via AssetPipelineFilter.groovy or AssetPipelineFilte...

CVE-2018-17605: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

PT-2018-14078

Name of the Vulnerable Software and Affected Versions Grails Asset Pipeline plugin versions prior to 3.0.4 Description An issue was discovered that allows an attacker to perform directory traversal via a crafted request when a servlet-based application is executed in Jetty. This is due to a...

Cross-Site Scripting (XSS)

Mort Bay jetty is vulnerable to cross-site scripting XSS. The server response from a directory listing request is not sanitized and allows an attacker to inject arbitrary Javascript into a victim's browser via a ; semicolon character...