GHSA-6JXP-7G74-2RC3 Improper input validation in Mort Bay Jetty

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-5047

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-4611. Reason: This candidate is a duplicate of CVE-2009-4611. Notes: All CVE users should reference CVE-2009-4611 rather than this candidate. All references and descriptions in this candidate have been removed to prevent...

PT-2019-6517 · Eclipse · Jetty

Name of the Vulnerable Software and Affected Versions: Jetty versions 6.x through 6.1.21 Description: The issue concerns an escape sequence injection vulnerability that can be exploited through two vectors: the "Cookie Dump Servlet" and the HTTP Content-Length header. Specifically, a POST request...

Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2019-42375)

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the Cookie Dump Servlet in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from a lack of proper validation of client-side...

CVE-2009-5048

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5048

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5048

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

Cross site scripting

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5048

Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20...

CVE-2009-5048

CVE-2009-5048 is a stored XSS in the Jetty project, specifically the Cookie Dump Servlet, affecting Jetty 6.1.x up to 6.1.20. The root cause is improper validation of user-supplied input in the Cookie Dump Servlet, enabling an attacker to inject script that could access cookie-based credentials. ...