HTTP security headers are not present for app's servlet but are sent on regular Confluence page

h3. Summary When creating a servlet in a plugin/app, and accessing the servlet in the browser, you notice that security headers are not included: !Screenshot 2018-11-06 at 15.34.38.png|thumbnail! Unlike when accessing a Confluence Page: !Screenshot 2018-11-06 at 15.34.15.png|thumbnail! Notice the...

Apache Tomcat 8.5.16 < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.24. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.2. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-examples-java (1.0.0rc0), org.cometd.java:cometd-java-oort (1.0.0rc0) +33 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-examples-java 1.0.0rc0 - org.cometd.java:cometd-java-oort 1.0.0rc0 -...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.v20100505), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.v20100505) +34 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.1.0.v20100505)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.v20100505 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.v20100505 -...

org.cometd.java:cometd-examples-java (1.1.2), org.cometd.java:cometd-java-examples (2.0.0) +41 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.1.5.v20100705)

org.eclipse.jetty:jetty-server MAVEN version 7.1.5.v20100705 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-examples-java 1.1.2 - org.cometd.java:cometd-java-examples 2.0.0 -...

com.googlecode.mycontainer:maven-mycontainer-plugin (>=1.2.29, <=1.2.51), com.googlecode.mycontainer:mycontainer-gae-web (>=1.2.29, <=1.2.51) +49 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.4.0.v20110414)

org.eclipse.jetty:jetty-server MAVEN version 7.4.0.v20110414 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.googlecode.mycontainer:maven-mycontainer-plugin =1.2.29, =1.2.29, =1.2.29, =1.2.29,...

com.yammer.dropwizard:dropwizard-client (0.2.1), com.yammer.dropwizard:dropwizard-core (0.2.1) +53 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.6.1.v20120215)

org.eclipse.jetty:jetty-server MAVEN version 7.6.1.v20120215 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.2.1 - com.yammer.dropwizard:dropwizard-core 0.2...

com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x (>=1.0.1, <=1.0.2), org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (>=1.4.15, <=1.6.7) +39 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.6.17.v20150415)

org.eclipse.jetty:jetty-server MAVEN version 7.6.17.v20150415 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x =1.0.1, =1.4.15, =1.6.7 -...

com.rexsl:rexsl-maven-plugin (>=0.2, <=0.13.3), com.rexsl:rexsl-standalone (>=0.3.8, <=0.13.3) +43 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (8.0.2.v20111006)

org.eclipse.jetty:jetty-server MAVEN version 8.0.2.v20111006 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.rexsl:rexsl-maven-plugin =0.2, =0.3.8, =0.13.3 - org.eclipse.jetty.aggregate:jetty-al...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc0) +42 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (8.1.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc2) +42 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (8.1.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc2) +28 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (7.0.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc3), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc3) +29 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (7.0.0.rc3)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc3 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-examples-java (1.0.0rc0), org.cometd.java:cometd-java-oort (1.0.0rc0) +33 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (7.0.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-examples-java 1.0.0rc0 - org.cometd.java:cometd-java-oort 1.0.0rc0 -...