CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

Code injection

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

CVE-2019-17632

CVE-2019-17632 affects Eclipse Jetty 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118. The issue: default unhandled error responses (text/html/text/json) may include unescaped exception messages in stacktraces, enabling leakage or potential cross-site scripting via error output. Connected...

CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output...

Eclipse Jetty Denial-of-service (CVE-2018-12545)

A denial-of-service vulnerability exists in Eclipse Jetty. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...

Eclipse Jetty Buffer Overflow Vulnerability

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A security vulnerability exists in Eclipse Jetty version 6.x prior to 6.1.22. An attacker could exploit the vulnerability to execute arbitrary code or dump buffer contents...

Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2019-42375)

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the Cookie Dump Servlet in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from a lack of proper validation of client-side...

Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2019-42378)

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the JSP Dump and Session Dump Servlets in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from a lack of proper validation ...

Eclipse Jetty Cross-Site Scripting Vulnerability

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the WebApp JSP Snoop page in EEclipse Jetty 6.1.21 and earlier versions. The vulnerability stems from a lack of proper validation of...

Eclipse Jetty Information Disclosure Vulnerability

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . An information disclosure vulnerability exists in Dump Servlet in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from errors such as configuration during operation of a...

CVE-2017-7657

In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration with RFC2616 compliance enabled, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a...

Security Bulletin: Vulnerability in Eclipse Jetty affecting Rational Functional Tester

Summary There is a vulnerability in Eclipse Jetty used by Rational Functional Tester RFT versions 9.1.1.1, 9.2.1.1 and 9.5.0.0. RFT has addressed the applicable CVE. Vulnerability Details Rational Functional Tester has addressed the following vulnerability: CVEID: CVE-2018-12545 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server

Summary Multiple vulnerabilities in Eclipse Jetty were addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2019-10247 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the DefaultHandler. By sending a...

Denial Of Service (DoS)

Eclipse Jetty is vulnerable to denial of service attacks. A remote, unauthenticated attacker could exploit the flawed SETTING Frame Handler component due to the additional CPU and memory allocations required to handle setting changes causing denial of service conditions...

Security Bulletin: Multiple vulnerabilities in Jetty affect Netcool Agile Service Manager (CVE-2019-10247, CVE-2019-10246)

Summary There are multiple vulnerabilities in Eclipse Jetty used by Netcool Agile Service Manager. Netcool Agile Service Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-10247 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information,...

Eclipse Jetty CVE-2019-10247 Information Disclosure Vulnerability

Description Eclipse Jetty is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Eclipse Jetty version 7.x, 8.x, 9.2.27 and prior, 9.3.26 and prior, and 9.4.16 and prior are vulnerable...

CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...