CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

PT-2026-57996

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description An issue exists where an HTTP URI containing a semicolon, such as /public;/../admin/secret.txt, results in an unresolved path of /public/../admin/secret.txt instead of the expected...

[SECURITY] Fedora 39 Update: rust-uu_readlink-0.0.23-3.fc39

readlink uutils display resolved path of PATHNAME...

GHSA-RJQ5-W47X-X359 @hono/node-server cannot handle "double dots" in URL

Impact Since v1.3.0, we use our own Request object. This is great, but the url behavior is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path. ts const req = new...

DoS in PureFTPd

PureFTPd all versions vulnerability. I. Entry. Vuln are all version deamons PureFTP. There is DoS bug. II. Vulnerability details. Vulnerability function is displayrate. There is simple overflow bug DoS: "in file src/ftpd.c" static void displayrateconst char word, offt size, const double started,...