https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:53:50 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-02668 bdu:2022-02668 https://cve.radiocsirt.org/vuln/bdu:2022-02668 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0357 certfr-2023-avi-0357 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0357 https://cve.radiocsirt.org/vuln/cnvd-2018-23743 cnvd-2018-23743 https://cve.radiocsirt.org/vuln/cnvd-2018-23743 https://cve.radiocsirt.org/vuln/euvd-2026-74854 EUVD-2026-74854 https://cve.radiocsirt.org/vuln/euvd-2026-74854 https://cve.radiocsirt.org/vuln/fkie_cve-2017-7656 <p>In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.</p> <p>In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-7656 https://cve.radiocsirt.org/vuln/ghsa-84q7-p226-4x5w <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-server</p> <p>Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), contain an HTTP Request Smuggling Vulnerability that can result in cache poisoning.</p> <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-server</p> <p>Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), contain an HTTP Request Smuggling Vulnerability that can result in cache poisoning.</p> https://cve.radiocsirt.org/vuln/ghsa-84q7-p226-4x5w https://cve.radiocsirt.org/vuln/gsd-2017-7656 gsd-2017-7656 https://cve.radiocsirt.org/vuln/gsd-2017-7656 https://cve.radiocsirt.org/vuln/rhsa-2020:3779 <p>jetty: HTTP request smuggling using the range header jetty: HTTP request smuggling jetty: Incorrect header handling jackson-mapper-asl: XML external entity similar to CVE-2016-3720 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class EAP: field-name is not parsed in accordance to RFC7230 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain undertow: AJP File Read/Inclusion Vulnerability Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass jackson-databind: Lacks certain xbean-reflect/JNDI blocking log4j: improper validation of certificate with host mismatch in SMTP appender jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution wildfly-elytron: session fixation when using FORM authentication jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.…</p> <p>jetty: HTTP request smuggling using the range header jetty: HTTP request smuggling jetty: Incorrect header handling jackson-mapper-asl: XML external entity similar to CVE-2016-3720 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class EAP: field-name is not parsed in accordance to RFC7230 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain undertow: AJP File Read/Inclusion Vulnerability Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass jackson-databind: Lacks certain xbean-reflect/JNDI blocking log4j: improper validation of certificate with host mismatch in SMTP appender jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution wildfly-elytron: session fixation when using FORM authentication jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.…</p> https://cve.radiocsirt.org/vuln/rhsa-2020:3779 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-7656 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9</p> <p>In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9</p> <p>In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-7656 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2993 <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2993