Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...

Cleartext Storage of Sensitive Information

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the SessionAuthentication process. An attacker can access plaintext passwords of authenticated...

DEBIAN-CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

DEBIAN-CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...