eclipse jetty 10.0.1 vulnerabilities and exploits

(subscribe to this query)

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that m...

Eclipse Jetty Eclipse Jetty 10.0.0 Eclipse Jetty 10.0.1 Eclipse Jetty 11.0.0 Eclipse Jetty 11.0.1 Fedoraproject Fedora 32 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Apache Ignite Apache Solr 8.8.1 Netapp Cloud Manager -Netapp E-series Performance Analyzer -

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web....

Eclipse Jetty 9.4.37 Eclipse Jetty 9.4.38 Netapp Cloud Manager -Netapp E-series Performance Analyzer -Netapp E-series Santricity Os Controller Netapp E-series Santricity Web Services -Netapp Element Plug-in For Vcenter Server -Netapp Santricity Cloud Connector -Netapp Snapcenter -Netapp Snapcenter Plug-in -Netapp Storage Replication Adapter For Clustered Data Ontap Netapp Vasa Provider For Clustered Data Ontap

1 Github repository

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Eclipse Jetty Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Element Manager 8.2.2 Oracle Communications Services Gatekeeper 7.0 Oracle Communications Session Report Manager Oracle Communications Session Route Manager Oracle Rest Data Services Oracle Siebel Core - Automation Jenkins Jenkins Netapp Cloud Manager Netapp E-series Performance Analyzer

1 Github repository

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-281...

Eclipse Jetty Netapp E-series Santricity Os Controller Netapp E-series Santricity Web Services -Netapp Element Plug-in For Vcenter Server -Netapp Hci Management Node -Netapp Snap Creator Framework -Netapp Snapcenter Plug-in -Netapp Solidfire -Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Communications Cloud Native Core Binding Support Function 1.10.0 Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.5.0 Oracle Communications Cloud Native Core Service Communication Proxy 1.14.0

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook