io.undertow:undertow-servlet (1.4.1.final), io.undertow:undertow-websockets-jsr (1.4.1.final) potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.4.1.final)

io.undertow:undertow-core MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.1.final - io.undertow:undertow-websockets-jsr 1.4.1.final Source cves:...

io.undertow:undertow-servlet (1.1.0.beta6), io.undertow:undertow-websockets-jsr (1.1.0.beta6) +1 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.1.0.beta6)

io.undertow:undertow-core MAVEN version 1.1.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta6 - io.undertow:undertow-websockets-jsr 1.1.0.beta6 -...

io.undertow:undertow-servlet (1.0.0.alpha4), io.undertow:undertow-websockets-jsr (1.0.0.alpha4) potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.0.0.alpha4)

io.undertow:undertow-core MAVEN version 1.0.0.alpha4 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha4 - io.undertow:undertow-websockets-jsr 1.0.0.alpha4 Source...

io.undertow:undertow-servlet (1.0.0.alpha11), io.undertow:undertow-websockets-jsr (1.0.0.alpha11) potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.0.0.alpha11)

io.undertow:undertow-core MAVEN version 1.0.0.alpha11 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha11 - io.undertow:undertow-websockets-jsr 1.0.0.alpha11 Source...

io.undertow:undertow-servlet (1.1.0.cr1), io.undertow:undertow-websockets-jsr (1.1.0.cr1) potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.1.0.cr1)

io.undertow:undertow-core MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.cr1 - io.undertow:undertow-websockets-jsr 1.1.0.cr1 Source cves:...

io.undertow:undertow-http2-test-suite (1.3.13.final), io.undertow:undertow-servlet (1.3.13.final) +1 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.3.13.final)

io.undertow:undertow-core MAVEN version 1.3.13.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.13.final - io.undertow:undertow-servlet 1.3.13.final -...

io.undertow:undertow-servlet (1.4.5.final), io.undertow:undertow-websockets-jsr (1.4.5.final) potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.4.5.final)

io.undertow:undertow-core MAVEN version 1.4.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.5.final - io.undertow:undertow-websockets-jsr 1.4.5.final Source cves:...

io.undertow:undertow-http2-test-suite (1.3.0.beta7), io.undertow:undertow-servlet (1.3.0.beta7) +1 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.3.0.beta7)

io.undertow:undertow-core MAVEN version 1.3.0.beta7 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta7 - io.undertow:undertow-servlet 1.3.0.beta7 -...

Apache Tomcat vulnerable to SecurityManager bypass

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

GHSA-3MJP-P938-4329 Apache Tomcat vulnerable to SecurityManager bypass

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

DEBIAN-CVE-2022-22970

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...

UBUNTU-CVE-2022-22970

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...

PT-2022-15751

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.3.20 Spring Framework versions prior to 5.2.22 Spring Framework old unsupported versions Description The issue affects applications that handle file uploads and rely on data binding to set a MultipartFile o...

Stripe: Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443

Tomcat Servlet Examples were accessible from the internet. This report demonstrated that it was possible to disclose IP addresses of internal application servers...

GHSA-6JXP-7G74-2RC3 Improper input validation in Mort Bay Jetty

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

GHSA-8H77-9VH5-HW5G Mortbay Jetty vulnerable to Cross-site scripting

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

Direct Web Remoting vulnerable to Denial of Service

Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...

GHSA-HG5P-233H-C7FH Direct Web Remoting vulnerable to Denial of Service

Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...

Apache Tomcat AJP Connector Information Leak

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when...

GHSA-8V5P-2CPV-C2X6 Apache Tomcat Source Code Disclosure

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...