Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.mortbay.jetty:jetty

11 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11
Registry
Maven Central

Advisories 11

  • Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote…

    Affected: from 6.0.0, fixed in 6.1.23; from 7.0.0, fixed in 7.0.2.

  • Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote…

    Affected: fixed in 6.1.17; from 7.0.0.M0, fixed in 7.0.0.M2.

  • Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/'…

    Affected: from 6.1.5, fixed in 6.1.7.

  • CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…

    Affected: fixed in 6.1.6rc0.

  • Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers…

    Affected: fixed in 6.1.6.

  • Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web…

    Affected: fixed in 6.1.6.

  • jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and…

    Affected: fixed in 6.0.0.

  • Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded…

    Affected: through 6.0.beta16.

  • Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests…

    Affected: fixed in 5.1.6.

  • HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application…

    Affected: fixed in 4.2.19.

  • Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an…

    Affected: fixed in 4.1.1.