jetty: Ambiguous paths can access WEB-INF

In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application...

CVE-2019-18209

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

PT-2019-15277

Name of the Vulnerable Software and Affected Versions Etherpad-Lite version 1.7.5 Description The issue arises in the templates/pad.html file of Etherpad-Lite when the browser does not properly encode the path of the URL, leading to a cross-site scripting XSS vulnerability. This has been...

DEBIAN-CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

udev multiple security vulnerabilities

Privilege escalation with NETLINK messages, buffer overflow on path encoding...