CVE-2007-5615

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2007-5613

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

CVE-2007-5613

CVE-2007-5613 is an XSS vulnerability in Mortbay Jetty’s Dump Servlet prior to 6.1.6rc1. An attacker can inject arbitrary script/HTML via unspecified parameters and cookies, enabling potential client-side script execution in affected web applications. Impact is described in the connected advisori...

CVE-2007-5614

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

CVE-2007-5615

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2007-5615

Jetty (Mortbay Jetty) is affected by CVE-2007-5615: a CRLF injection vulnerability in Jetty before 6.1.6rc0 that could let remote attackers inject arbitrary HTTP headers and perform HTTP response splitting. IBM/OpenVAS/ Fedora references corroborate the vulnerability in Jetty and list related CVE...

CVE-2007-5614

CVE-2007-5614 affects Mortbay Jetty prior to 6.1.6rc1, where improper handling of certain quote sequences in HTML cookie parameters can lead to remote session hijacking via unspecified vectors. This is documented in the original vulnerability description plus multiple vulnerability references (in...

jetty -- multiple vulnerabilities

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies. Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters...

Mort Bay Jetty Dump Servlet (webapps/test/jsp/dump.jsp) XSS

The remote instance of Mort Bay Jetty includes a test servlet, 'webapps/test/jsp/dump.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

Mortbay Jetty fails to properly handle cookies with quotes

Overview Mortbay Jetty fails to properly handle cookie quotes, which may allow session hijacking. Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle cookies with certain quote sequences. This can cause the Jetty cookie parsing mechanism to improperly...

Mortbay Jetty Dump Servlet vulnerable to cross-site scripting

Overview The Mortbay Jetty Dump Servlet contains a cross-site scripting vulnerability. Description Mortbay Jetty is a web server that is written in Java. The Dump Servlet that is included with Jetty is vulnerable to cross-site scripting. Note that according to the vendor, the Dump Servlet is for...

Mortbay Jetty vulnerable to HTTP response splitting

Overview Mortbay Jetty is vulnerable to HTTP response splitting, which may allow a remote, unauthenticated attacker to inject various HTTP headers Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle HTTP headers with CRLF sequences, which can allow an...

Jetty < 6.1.6 Multiple Vulnerabilities

Binary data 4307.prm...

CVE-2006-6969

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

CVE-2006-6969

Jetty (versions: before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, 6.1 before 6.1.0pre3) uses java.util.Random to generate session IDs. This leads to predictable session identifiers that remote attackers could brute-force to guess sessions, potentially bypass authentication and enable cross-sit...

CVE-2006-6969

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

Jetty可预测随机会话ID漏洞

Jetty是一款流行的Java Web服务器。 Jetty的会话ID随机生成实现上存在漏洞，远程攻击者可能利用此漏洞获取非授权访问。 Jetty使用java.util.Random生成会话ID。java.util.random实现以下形式的线性同余随机数生成器： synchronized protected int nextint bits seed = seed 0x5DEECE66DL + 0xBL & 1L 48 - 1; return intseed 48 - bits;...

Jetty Non-random Session ID Vulnerability

Binary data 3904.prm...

Jetty web server weak pseudo-random number generator

Weak PRNG generator is used for session cookie making it's possible to spoof the session id...

Jetty Session ID Prediction

======= Summary ======= Name: Jetty Session Id Prediction Release Date: 5 February 2007 Reference: NGS00471 Discover: Chris Anley [email protected] Vendor: Mortbay Systems Affected: Jetty prior to versions 4.2.27, 5.1.12, 6.0.2 and 6.1.0pre3 Risk: High Status: Fixed ======== TimeLine ========...