CVE-2007-6672

Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' slash characters in the URI...

Jetty双斜线URI处理信息泄露漏洞

BUGTRAQ ID: 27117 Jetty是一款流行的Java Web服务器。 Jetty处理用户请求时存在漏洞，远程攻击者可能利用此漏洞绕过访问验证获取敏感信息。 如果未经认证的远程攻击者向Jetty服务器提交了包含有两个斜线字符（/）的特制URI请求的话，就可以查看隐藏的或保密的文件和目录。 Jetty Jetty 6.1.6 Jetty Jetty 6.1.5 Jetty ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://docs.codehaus.org/display/JETTY/Downloading+and+Installin...

CVE-2007-6672: Improper Limitation of a Pathname to a Restricted Directory

Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' slash characters in the URI...

Mort Bay Jetty URL Multiple Slash Character Information Disclosure

The remote instance of Mort Bay Jetty allows an attacker to view static content in WEB-INF and behind security constraints because of the approach it uses to compact URLs like '/foo///bar'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

Mort Bay Jetty < 6.1.7 Double Slash Information Disclosure

Binary data 4330.prm...

Jetty fails to properly process URLs that contain double / characters

Overview The Jetty web server contains a vulnerability that may allow an attacker to access private files or directories. Description Jetty is a web server that is implemented in Java. Jetty contains a vulnerability in the way it processes URLs with multiple "/" slash characters. See the Jetty...

jetty -- multiple vulnerability

Greg Wilkins reports: jetty allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI...

FreeBSD : jetty -- multiple vulnerabilities (6ae7cef2-a6ae-11dc-95e6-000c29c5647f)

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies. Mortbay Jetty before 6.1.6rc1 does not properly handle 'certain quote sequences' in HTML cookie parameters...

CVE-2007-5613

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

CVE-2007-5614

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

Crlf injection

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

CVE-2007-5615

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Hardcoded credentials

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

CVE-2007-5613

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

CVE-2007-5613

CVE-2007-5613 is an XSS vulnerability in Mortbay Jetty’s Dump Servlet prior to 6.1.6rc1. An attacker can inject arbitrary script/HTML via unspecified parameters and cookies, enabling potential client-side script execution in affected web applications. Impact is described in the connected advisori...

CVE-2007-5614

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors...

CVE-2007-5615

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2007-5615

Jetty (Mortbay Jetty) is affected by CVE-2007-5615: a CRLF injection vulnerability in Jetty before 6.1.6rc0 that could let remote attackers inject arbitrary HTTP headers and perform HTTP response splitting. IBM/OpenVAS/ Fedora references corroborate the vulnerability in Jetty and list related CVE...

CVE-2007-5614

CVE-2007-5614 affects Mortbay Jetty prior to 6.1.6rc1, where improper handling of certain quote sequences in HTML cookie parameters can lead to remote session hijacking via unspecified vectors. This is documented in the original vulnerability description plus multiple vulnerability references (in...