Eclipse

Jetty

45 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2017-7656

  • EPSS 7.77%
  • Veröffentlicht 26.06.2018 15:29:00
  • Zuletzt bearbeitet 21.11.2024 03:32:23

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declare...

8.8

CVE-2018-12538

  • EPSS 0.52%
  • Veröffentlicht 22.06.2018 19:29:00
  • Zuletzt bearbeitet 21.11.2024 03:45:23

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatche...

7.5

CVE-2017-9735

  • EPSS 0.84%
  • Veröffentlicht 16.06.2017 21:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

9.8

CVE-2016-4800

  • EPSS 0.61%
  • Veröffentlicht 13.04.2017 14:59:01
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related ...

7.5

CVE-2015-2080

Exploit
  • EPSS 92.41%
  • Veröffentlicht 07.10.2016 14:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.