app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +166 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=10.0.0, <=10.0.15)

org.eclipse.jetty:jetty-servlets MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =100.300.3168, =3.0.0, =3.0.6 -...

ai.h2o:h2o-app (>=3.30.0.7, <=3.46.0.12), ai.h2o:h2o-jetty-9 (>=3.22.1.1, <=3.46.0.12) +4145 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=9.0.0.v20130308, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-servlets MAVEN version =9.0.0.v20130308, =3.30.0.7, =3.22.1.1, =3.38.0.1, =0.2.10, =2.1.56, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =0.2.10, =2.1.56, =3.30.0.5-1-3.0, =2.1.56, =3.30.0.5-1-3.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc,...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +227 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.15)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 and more Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee9.demos:jetty-ee9-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee9.demos:jetty-ee9-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1) +3 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee9:jetty-ee9-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee9:jetty-ee9-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee9.demos:jetty-ee9-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee9.demos:jetty-ee9-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1) +3 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee9:jetty-ee9-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee9:jetty-ee9-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee8:jetty-ee8-home (>=12.0.0.alpha0, <=12.0.0.beta1) +1 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee8:jetty-ee8-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee8:jetty-ee8-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update

Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 Multiple Vulnerabilities (APSB16-05)

The version of Adobe Experience Manager installed on the remote host is either 5.6.1, 6.0.0, or 6.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB16-05 advisory. - Adobe Experience Manager version 6.1 is affected by a cross-site scripting vulnerability that...

Oracle Linux 7 : tomcat (ELSA-2019-2205)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2205 advisory. - Resolves: rhbz1641873 CVE-2018-11784 tomcat: Open redirect in default servlet - Resolves: rhbz1552375 CVE-2018-1304 tomcat: Incorrect handling of emp...

Authorization Rule Misconfiguration

spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchersString function with multiple servlets, one of them being...

Spring Security Configuration Error Auth Bypass Info Disclosure

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to errors in authentication configuration. These errors can occur when using multiple servlets, including the DispatcherServlet in Spring MVC. Exploiting this vulnerability allows a...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

GHSA-4VPR-XFRP-CJ64 Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Spring Security security vulnerabilities

VMware Spring Security is a security framework from VMware that provides illustrative security protection for Spring-based applications. A security vulnerability exists in Spring Security that stems from an authorization rule misconfiguration when using multiple servlets. Affected Products and...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +19 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.rc6)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

OutOfMemoryError for large multipart without filename in Eclipse Jetty

Impact Servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part that has a name but no filename and a very large content. This...

CVE-2023-26048

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part...