org.eclipse.jetty.aggregate:jetty-all (7.4.1.v20110513), org.eclipse.jetty.aggregate:jetty-all-server (7.4.1.v20110513) +56 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.4.1.v20110513)

org.eclipse.jetty:jetty-server MAVEN version 7.4.1.v20110513 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.1.v20110513 -...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc1) +43 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.5.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.6.6.v20120903), org.eclipse.jetty.aggregate:jetty-all-server (7.6.6.v20120903) +51 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.6.6.v20120903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.6.v20120903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.6.v20120903 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc5) +43 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (8.1.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc2) +28 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.0.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

io.restx:restx-server-jetty7 (>=0.35-rc1, <=0.35.1), org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (>=1.6.8, <=1.8.2) +41 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.6.21.v20160908)

org.eclipse.jetty:jetty-server MAVEN version 7.6.21.v20160908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - io.restx:restx-server-jetty7 =0.35-rc1, =1.6.8, =1.8.3, =1.9.4 -...

GHSA-V596-FWHQ-8X48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

tomcat: Late application of security constraints can lead to resource exposure for unauthorised users

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...

Apache Tomcat Open Redirect vulnerability

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

GHSA-5Q99-F34M-67GC Apache Tomcat Open Redirect vulnerability

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

undertow: Path traversal in ServletResourceManager class

A path traversal vulnerability was discovered in Undertow's org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method. This could lead to information disclosure of arbitrary local files...

CentOS 7 : tomcat (CESA-2018:2921)

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

GHSA-96JQ-75WH-2658 Moderate severity vulnerability that affects apache axis

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...

Apache Tomcat 8.5.0 < 8.5.34

The version of Tomcat installed on the remote host is prior to 8.5.34. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.34security-8 advisory. - When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90...

Apache Tomcat Open Redirect Vulnerability

Apache Tomcat is a lightweight Web application server. Apache Tomcat suffers from an open redirection vulnerability, where when the default servlet returns a redirection to a directory e.g., to '/ foo /' when a user requests '/ foo', a specially crafted URL can be used to generate the redirection...