https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:17:44 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-02206 bdu:2022-02206 https://cve.radiocsirt.org/vuln/bdu:2022-02206 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0357 certfr-2023-avi-0357 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0357 https://cve.radiocsirt.org/vuln/cnvd-2021-28268 cnvd-2021-28268 https://cve.radiocsirt.org/vuln/cnvd-2021-28268 https://cve.radiocsirt.org/vuln/euvd-2026-74855 EUVD-2026-74855 https://cve.radiocsirt.org/vuln/euvd-2026-74855 https://cve.radiocsirt.org/vuln/fkie_cve-2017-7658 <p>In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.</p> <p>In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-7658 https://cve.radiocsirt.org/vuln/ghsa-6x9x-8qw9-9pp6 <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-server</p> <p>Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.</p> <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-server</p> <p>Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.</p> https://cve.radiocsirt.org/vuln/ghsa-6x9x-8qw9-9pp6 https://cve.radiocsirt.org/vuln/gsd-2017-7658 gsd-2017-7658 https://cve.radiocsirt.org/vuln/gsd-2017-7658 https://cve.radiocsirt.org/vuln/rhsa-2020:3779 <p>jetty: HTTP request smuggling using the range header jetty: HTTP request smuggling jetty: Incorrect header handling jackson-mapper-asl: XML external entity similar to CVE-2016-3720 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class EAP: field-name is not parsed in accordance to RFC7230 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain undertow: AJP File Read/Inclusion Vulnerability Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass jackson-databind: Lacks certain xbean-reflect/JNDI blocking log4j: improper validation of certificate with host mismatch in SMTP appender jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution wildfly-elytron: session fixation when using FORM authentication jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.…</p> <p>jetty: HTTP request smuggling using the range header jetty: HTTP request smuggling jetty: Incorrect header handling jackson-mapper-asl: XML external entity similar to CVE-2016-3720 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class EAP: field-name is not parsed in accordance to RFC7230 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain undertow: AJP File Read/Inclusion Vulnerability Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass jackson-databind: Lacks certain xbean-reflect/JNDI blocking log4j: improper validation of certificate with host mismatch in SMTP appender jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution wildfly-elytron: session fixation when using FORM authentication jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider jackson-databind: Serialization gadgets in javax.swing.…</p> https://cve.radiocsirt.org/vuln/rhsa-2020:3779 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-7658 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9</p> <p>In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9</p> <p>In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-7658