XML External Entity (XXE) Injection

jetty-xml is vulnerable to XML External Entity XXE Injection. The vulnerability exists because the XmlParser function of XmlParser.java does not sanitize the DOCTYPE declaration, which allows an attacker to inject maliciously crafted XML. Note that it is the vendors position that an attacker woul...

org.eclipse.jetty.aggregate:jetty-all (7.6.6.v20120903), org.eclipse.jetty.aggregate:jetty-all-server (7.6.6.v20120903) +28 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.6.v20120903)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.6.v20120903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.6.v20120903 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.19.v20160209), org.eclipse.jetty.aggregate:jetty-all-server (7.6.19.v20160209) +22 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.19.v20160209)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.19.v20160209 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.19.v20160209 -...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.rc1) +21 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.1.0.rc1)

org.eclipse.jetty:jetty-xml MAVEN version 7.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.apache.geronimo.assemblies:geronimo-jetty7-javaee5 (2.2.1), org.apache.geronimo.assemblies:geronimo-jetty7-minimal (2.2.1) +80 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.2.1.v20101111)

org.eclipse.jetty:jetty-xml MAVEN version 7.2.1.v20101111 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty7-javaee5 2.2.1 -...

org.eclipse.jetty.aggregate:jetty-all (7.4.3.v20110701), org.eclipse.jetty.aggregate:jetty-all-server (7.4.3.v20110701) +26 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.4.3.v20110701)

org.eclipse.jetty:jetty-xml MAVEN version 7.4.3.v20110701 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.3.v20110701 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (7.6.0.rc5) +28 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.0.rc5)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.1.3.v20100526), org.eclipse.jetty.aggregate:jetty-all-server (7.1.3.v20100526) +21 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.1.3.v20100526)

org.eclipse.jetty:jetty-xml MAVEN version 7.1.3.v20100526 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.3.v20100526 -...

org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 (3.0-m1), org.apache.geronimo.assemblies:geronimo-jetty8-minimal (3.0-m1) +55 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (8.0.0.m0)

org.eclipse.jetty:jetty-xml MAVEN version 8.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc4), org.eclipse.jetty.aggregate:jetty-all-server (7.6.0.rc4) +28 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.0.rc4)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc4 - org.eclipse.jetty.aggregate:jetty-all-server...

no.bekk.bekkopen.cde:webapp (0.2), org.eclipse.jetty.aggregate:jetty-all (8.0.1.v20110908) +24 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (8.0.1.v20110908)

org.eclipse.jetty:jetty-xml MAVEN version 8.0.1.v20110908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - no.bekk.bekkopen.cde:webapp 0.2 - org.eclipse.jetty.aggregate:jetty-all 8.0.1.v20110908 -...

org.eclipse.jetty.aggregate:jetty-all (7.1.2.v20100523), org.eclipse.jetty.aggregate:jetty-all-server (7.1.2.v20100523) +21 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.1.2.v20100523)

org.eclipse.jetty:jetty-xml MAVEN version 7.1.2.v20100523 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.2.v20100523 -...

org.eclipse.jetty.aggregate:jetty-all (7.5.1.v20110908), org.eclipse.jetty.aggregate:jetty-all-server (7.5.1.v20110908) +37 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.5.1.v20110908)

org.eclipse.jetty:jetty-xml MAVEN version 7.5.1.v20110908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.1.v20110908 -...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.4.0), org.eclipse.jetty.aggregate:jetty-all (7.6.10.v20130312) +29 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.10.v20130312)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.10.v20130312 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.4.0 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.6.0.rc2) +28 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.0.rc2)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

ai.h2o:h2o-algos (>=3.8.1.4, <=3.22.0.5), ai.h2o:h2o-app (>=3.8.1.4, <=3.22.0.5) +88 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (8.1.17.v20150415)

org.eclipse.jetty:jetty-xml MAVEN version 8.1.17.v20150415 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - ai.h2o:h2o-algos =3.8.1.4, =3.8.1.4, =3.12.0.1, =3.8.2.4, =3.8.1.4, =3.14.0.7, =3.16.0.1,...

edu.washington.cs.knowitall.nlptools:nlptools-conf-breeze_2.10 (2.4.1), edu.washington.cs.knowitall.nlptools:nlptools-conf-breeze_2.9.2 (>=2.2.4, <=2.4.1) +158 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.0.v20120127)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.0.v20120127 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - edu.washington.cs.knowitall.nlptools:nlptools-conf-breeze2.10 2.4.1 -...

com.cloudhopper:ch-jetty (1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (1.0.0) +31 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.14.v20131031)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.14.v20131031 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - com.cloudhopper:ch-jetty 1.0.2 - org.akhikhl.gretty:gretty-runner-jetty7 1.0.0 -...

org.eclipse.jetty.aggregate:jetty-all (7.4.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.4.0.rc0) +24 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.4.0.rc0)

org.eclipse.jetty:jetty-xml MAVEN version 7.4.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

io.restx:restx-server-jetty7 (>=0.35-rc1, <=0.35.1), org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (>=1.6.8, <=1.8.2) +25 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.6.21.v20160908)

org.eclipse.jetty:jetty-xml MAVEN version 7.6.21.v20160908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - io.restx:restx-server-jetty7 =0.35-rc1, =1.6.8, =1.8.3, =1.9.4 -...