Denial Of Service (DoS)

org.eclipse.jetty:jetty-servlets is vulnerable to Denial Of Service DoS. The vulnerability is due to unauthenticated users being able to exhaust the server's memory, leading to a crash...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-6762 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-6762 Source advisory: OSV:GHSA-R7M4-F9H5-GR79...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-6762 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-6762 Source advisory: GHSA-R7M4-F9H5-GR79...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-9823 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-9823 Source advisory: GHSA-J26W-F9RQ-MR2Q...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-9823 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-9823 Source advisory: OSV:GHSA-J26W-F9RQ-MR2Q...

ai.h2o:h2o-app (>=3.30.0.7, <=3.46.0.12), ai.h2o:h2o-jetty-9 (>=3.22.1.1, <=3.46.0.12) +4305 more potentially affected by CVE-2024-9823 via org.eclipse.jetty:jetty-servlets (>=9.0.0.v20130308, <=9.4.53.v20231009)

org.eclipse.jetty:jetty-servlets MAVEN version =9.0.0.v20130308, =3.30.0.7, =3.22.1.1, =3.38.0.1, =0.2.10, =2.1.56, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =0.2.10, =2.1.56, =3.30.0.5-1-3.0, =2.1.56, =3.30.0.5-1-3.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc,...

app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +178 more potentially affected by CVE-2024-9823 via org.eclipse.jetty:jetty-servlets (>=10.0.0, <=10.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =100.300.3168, =3.0.0, =3.0.6 -...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-6762 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-6762 Source advisory: MEND:CVE-2024-6762...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +241 more potentially affected by CVE-2024-9823 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.17)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.2 - com.chutneytesting:chutney-kotlin-dsl 2.2.2 and more Source cves: CVE-2024-9823 Source advisory: MEND:CVE-2024-9823...

Arbitrary Code Execution

Jetty-servlets is vulnerable to Arbitrary Code Execution. The vulnerability is due to insecure escaping of user input which can result in the execution of arbitrary commands. This vulnerability occurs in the CGI servlet handler through the getRuntime.exec method...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +227 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.15)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 and more Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +166 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=10.0.0, <=10.0.15)

org.eclipse.jetty:jetty-servlets MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =100.300.3168, =3.0.0, =3.0.6 -...

be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), co.ntbl.dropwizard:dropwizard-jooq (>=100.400.3168, <=100.400.3183) +227 more potentially affected by CVE-2023-36479 via org.eclipse.jetty:jetty-servlets (>=11.0.0, <=11.0.15)

org.eclipse.jetty:jetty-servlets MAVEN version =11.0.0, =4.0.0-beta.1, =100.400.3168, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.5, =7.0.0, =2.2.1, =2.2.1, =2.2.1, =2.2.2 and more Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update

Red Hat AMQ Streams 2.5.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +19 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.rc6)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

Information Disclosure

jetty-servlets is vulnerable to information disclosure. Lack of proper handling of requests to the ConcatServlet with a doubly encoded path allows an attacker to access protected resources within the WEB-INF directory. For example, sending /concat?/%2557EB-INF/web.xml can retrieve the web.xml fil...

org.cometd.java:cometd-java-examples (>=2.6.0-rc1, <=2.6.0), org.cometd:cometd-demo (>=2.6.0-rc1, <=2.6.0) +8 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.6.10.v20130312)

org.eclipse.jetty:jetty-servlets MAVEN version 7.6.10.v20130312 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd.java:cometd-java-examples =2.6.0-rc1, =2.6.0-rc1, =2.6.0 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.20.v20160902), org.eclipse.jetty.aggregate:jetty-all-server (7.6.20.v20160902) +4 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.6.20.v20160902)

org.eclipse.jetty:jetty-servlets MAVEN version 7.6.20.v20160902 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.20.v20160902 -...

org.eclipse.jetty:jetty-test-webapp (7.0.0.m1) potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.0.0.m1)

org.eclipse.jetty:jetty-servlets MAVEN version 7.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.eclipse.jetty:jetty-test-webapp 7.0.0.m1 Source cves: CVE-2021-28169 Source advisory:...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.m3), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.m3) +1 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.0.0.m3)

org.eclipse.jetty:jetty-servlets MAVEN version 7.0.0.m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.m3 - org.eclipse.jetty.aggregate:jetty-all-serve...