Lucene search

K

9 matches found

CVE
CVE
added 2023/10/10 2:15 p.m.4765 views

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

7.5CVSS8AI score0.94422EPSS
In wildWeb
CVE
CVE
added 2023/04/18 9:15 p.m.540 views

CVE-2023-26048

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with @MultipartConfig) that call HttpServletRequest.getParameter() or HttpServletRequest.getParts() may cause OutOfMemoryError when the client sends a multipart request with a p...

5.3CVSS5.9AI score0.36142EPSS
CVE
CVE
added 2023/04/18 9:15 p.m.524 views

CVE-2023-26049

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " (double qu...

5.3CVSS5.1AI score0.00263EPSS
CVE
CVE
added 2022/07/07 9:15 p.m.506 views

CVE-2022-2047

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

4CVSS5.2AI score0.00808EPSS
CVE
CVE
added 2021/06/09 2:15 a.m.435 views

CVE-2021-28169

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2,

5.3CVSS5.2AI score0.92092EPSS
In wildWeb
CVE
CVE
added 2022/07/07 9:15 p.m.368 views

CVE-2022-2048

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left ...

7.5CVSS7.3AI score0.00979EPSS
CVE
CVE
added 2017/06/16 9:29 p.m.161 views

CVE-2017-9735

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

7.5CVSS7.3AI score0.00522EPSS
CVE
CVE
added 2019/11/06 8:15 p.m.91 views

CVE-2009-5046

JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.

6.1CVSS6AI score0.00694EPSS
CVE
CVE
added 2019/11/06 8:15 p.m.90 views

CVE-2009-5045

Dump Servlet information leak in jetty before 6.1.22.

7.5CVSS7.3AI score0.01414EPSS