Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse jetty-ee10-jaspi library that could cause broken access controls, potentially allowing unauthorized access or privilege escalation. (CVE-2026-5795).

Summary IBM Storage Protect Server uses the Eclipse jetty-ee10-jaspi library in certain components. A vulnerability in Jetty could cause authentication context being retained in ThreadLocal variables and inadvertently reused by subsequent requests processed on the same thread. This can lead to...

PT-2026-67497

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.10.0 Description The application REST API supports gzip-encoded HTTP requests via a Jersey encoding filter. The framework enforces a maximum request size on the compressed payload instead of the decompresse...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse http2-common library that could cause resource exhaustion (CVE-2025-5115).

Summary IBM Storage Protect Server uses the Eclipse http2-common library in certain components. A vulnerability in http2-common could cause malicious client to repeatedly send malformed or invalid HTTP/2 frames, forcing the server to generate excessive RSTSTREAM responses. This can result in...

Eclipse Jetty - Directory Listing Enabled Detection

Eclipse Jetty server has directory listing enabled, which exposes the directory structure and file names to unauthenticated users. This can reveal sensitive files, backup files, configuration files, and aid attackers in reconnaissance. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage Detection

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty before 9.""" from kittysploit import from lib.protocols.http.httpclient import...

Jetty showContexts Enable in DefaultHandler Detection

Jetty showContexts is Enabled in DefaultHandler !/usr/bin/env python3 -- coding: utf-8 -- """Jetty showContexts is Enabled in DefaultHandler.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jetty showContexts Enable ...

Eclipse Jetty ConcatServlet - Information Disclosure Detection

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

CData Sync < 23.4.8843 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control Detection

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Apache...

CData Connect < 23.4.8846 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. !/usr/bin/env python3 -- coding: utf-8 -- """A path...

CData API Server < 23.4.8844 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. !/usr/bin/env python3 -- coding: utf-8 -- """A path...

CData Arc < 23.4.8839 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Jetty Default Page Detection

Detects Jetty Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jetty Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jetty Default Page Detection', 'description': 'Detects Jetty Defaul...

Malicious Package

Overview jetty-lettuce-q489 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview jetty-xigua-p5wn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and ifix Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

Information Exposure

org.eclipse.jetty, jetty-server is vulnerable to Information Exposure. The vulnerability is due to improper handling of HTTP/1.1 request trailers, where trailers from a previous request are retained and reused across subsequent requests on the same connection, which allows an attacker to access o...

Improper Authentication

Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Third Party Eclipse...

CVE-2026-10050

creationtimestamp| type| source ---|---|--- 2026-07-23 00:35:03+00:00| published-proof-of-concept| https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr 2026-08-09 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msmm66wcux2o 2026-09-19 18:09:28+00:00|...