Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
jetty vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2018-17605
An issue exists in the Asset Pipeline plugin prior to 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal ro...
Asset Pipeline Project Asset-pipeline
5
CVSSv2
CVE-2018-12536
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can t...
Eclipse Jetty
Oracle Retail Xstore Point Of Service 15.0
Oracle Retail Xstore Point Of Service 16.0.0
Oracle Retail Xstore Point Of Service 7.1
Oracle Retail Xstore Point Of Service 17.0
5
CVSSv2
CVE-2017-7656
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was ac...
Eclipse Jetty
Debian Debian Linux 9.0
5
CVSSv2
CVE-2014-3626
The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the norm...
Grails Resources
5
CVSSv2
CVE-2017-9735
Jetty up to and including 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote malicious users to obtain access by observing elapsed times before rejection of incorrect passwords.
Eclipse Jetty
Debian Debian Linux 9.0
Oracle Retail Xstore Point Of Service 15.0
Oracle Retail Xstore Point Of Service 7.1
Oracle Hospitality Guest Access 4.2.0
Oracle Hospitality Guest Access 4.2.1
Oracle Retail Xstore Point Of Service 16.0
Oracle Enterprise Manager Base Platform 13.3
Oracle Enterprise Manager Base Platform 13.2
Oracle Retail Xstore Point Of Service 17.0
Oracle Rest Data Services 12.2.0.1
Oracle Rest Data Services 12.1.0.2
Oracle Rest Data Services 11.2.0.4
Oracle Rest Data Services 18c
Oracle Communications Cloud Native Core Policy 1.5.0
5
CVSSv2
CVE-2015-2080
The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote malicious users to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Fedoraproject Fedora 22
Eclipse Jetty 9.3.0
Eclipse Jetty 9.2.3
Eclipse Jetty 9.2.8
Eclipse Jetty 9.2.5
Eclipse Jetty 9.2.4
Eclipse Jetty 9.2.7
Eclipse Jetty 9.2.6
1 EDB exploit
5
CVSSv2
CVE-2011-4461
Jetty 8.1.0.RC2 and previous versions computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote malicious users to cause a denial of service (CPU consumption) by sending many crafted parameters.
Oracle Sun Storage Common Array Manager 6.9.0
Mortbay Jetty 7.0.0
Mortbay Jetty 6.1.16
Mortbay Jetty 6.1.15
Mortbay Jetty 6.1.11
Mortbay Jetty 6.1.12
Mortbay Jetty 6.1.4
Mortbay Jetty 6.1.2
Mortbay Jetty 6.1.1
Mortbay Jetty 6.1.0
Mortbay Jetty 6.0.0
Mortbay Jetty 5.1.14
Mortbay Jetty 5.0
Mortbay Jetty 5.1.12
Mortbay Jetty 5.1.11
Mortbay Jetty 5.1.5
Mortbay Jetty 5.1.0
Mortbay Jetty 5.1
Mortbay Jetty 5.1.3
Mortbay Jetty 4.2.17
Mortbay Jetty 4.2.22
Mortbay Jetty 4.2.15
1 Article
5
CVSSv2
CVE-2011-4404
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote malicious users to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a re...
Vmware Vcenter Update Manager 4.1
Vmware Vcenter Update Manager 4.0
1 EDB exploit
5
CVSSv2
CVE-2010-1587
The Jetty ResourceHandler in Apache ActiveMQ 5.x prior to 5.3.2 and 5.4.x prior to 5.4.0 allows remote malicious users to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
Apache Activemq 5.3.0
Apache Activemq 5.3.1
Apache Activemq 5.0.0
Apache Activemq 5.4-snapshot
Apache Activemq 5.1.0
Apache Activemq 5.2.0
1 EDB exploit
5
CVSSv2
CVE-2009-4609
The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote malicious users to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.
Mortbay Jetty 6.1.16
Mortbay Jetty 6.1.15
Mortbay Jetty 6.1.12
Mortbay Jetty 6.1.7
Mortbay Jetty 6.1.5
Mortbay Jetty 6.1.20
Mortbay Jetty 6.1.2
Mortbay Jetty 6.1.0
Mortbay Jetty 6.0.0
Mortbay Jetty 6.1.9
Mortbay Jetty 6.1.10
Mortbay Jetty 6.1.4
Mortbay Jetty 6.1.3
Mortbay Jetty 6.1.19
Mortbay Jetty 6.0.2
Mortbay Jetty 7.0.0
Mortbay Jetty 6.1.6
Mortbay Jetty 6.1.1
Mortbay Jetty 6.1.14
Mortbay Jetty 6.1.11
Mortbay Jetty 6.1.8
Mortbay Jetty 6.0.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48693
CVE-2024-30851
CVE-2024-34460
CVE-2024-2887
local
CVE-2024-27956
remote code execution
CVE-2024-34475
privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »