Debian: Security Advisory (DSA-5507-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5507-1] jetty9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5507-1 [email protected] https://www.debian.org/security/ Markus Koschany September 28, 2023 https://www.debian.org/security/faq -...

CVE-2023-41900 Jetty's OpenId Revoked authentication allows one request

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the...

SUSE SLED15: jetty-annotations / jetty-ant / jetty-cdi / jetty-client / etc (SUSE-SU-2023:2539-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2539-1 advisory. Updated to version 9.4.51.v20230217: - CVE-2023-26048: Fixed an excessive memory consumption whe...

CVE-2023-26048

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part...

CVE-2023-26049

Jetty cookie parsing vulnerability CVE-2023-26049 affects Jetty’s cookie handling where a cookie VALUE starting with a double quote can cause the parser to read past semicolons, effectively merging multiple cookies into one. This can enable cookie smuggling (e.g., exfiltrating HttpOnly cookies li...

CVE-2023-26048 OutOfMemoryError for large multipart without filename in Eclipse Jetty

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part...

CVE-2023-26048

CVE-2023-26048 (Jetty) affects Jetty’s Java-based web server/servlet engine. Affected servlets using multipart support (e.g., @MultipartConfig) calling HttpServletRequest.getParameter() or getParts() may trigger an OutOfMemoryError when a client sends a multipart part with a name but no filename ...

CVE-2023-29517: Exposure of Sensitive Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user...

Low: Red Hat Bug Fix Advisory: pki-servlet-engine bug fix and enhancement update

An update for pki-servlet-engine is now available for Red Hat Enterprise Linux 9. For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section...

pki-servlet-engine bug fix and enhancement update

An update is available for pki-servlet-engine. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

[SECURITY] [DSA 5198-1] jetty9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5198-1 [email protected] https://www.debian.org/security/ Markus Koschany August 02, 2022 https://www.debian.org/security/faq -...

new packages: pki-servlet-engine

An update is available for pki-servlet-engine. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Debian: Security Advisory (DSA-4949-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Eclipse Jetty has an arbitrary file download vulnerability

Jetty is a lightweight and highly scalable Java-based web server and servlet engine. Eclipse Jetty has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

apache-commons-collections jss 4.8.1-2 - Bug 1932803 - HSM + FIPS: CMCRequest with a shared secret resulting in error 4.8.1-1 - Rebase to upstream JSS v4.8.1 - Red Hat Bugilla 1908541 - jss broke SCEP - missing PasswordChallenge class - Red Hat Bugilla 1489256 - RFE jss should support RSA with OA...

HPESBUX04114 rev.1 - HP-UX 11iv3 Tomcat-based Servlet Engine7.0.104.01. Multiple Remote Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Privileged Information; Remote: Code Execution, Denial of Service DoS, Disclosure of Privileged Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX Tomcat-based Servlet v.7.x Engine D.7.0.104.01 a...

HPESBUX04015 rev.2 - HP-UX Tomcat-based Servlet Engine, Multiple Remote Vulnerabilities

Potential Security Impact: Local: Access Restriction Bypass; Remote: Access Restriction Bypass, Code Execution, Denial of Service DoS, Gain Unauthorized Access, URL Redirection, Unauthorized Access to Data, Unauthorized Access to Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted...

CVE-2019-12270

OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. T...

CVE-2019-12270

OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. T...