Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

34 records

Vendor: Oracle Component: Rest Data Services Clear all filters
TI-2021-18023 CVE-2021-41184 · GHSA-gpqq-952q-5327

XSS in the `of` option of the `.position()` util

Priority MEDIUM 57

jQuery-UI is the official jQuery user interface library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.40768 Published 2021-10-26 Partial fix · 1.13.0, 7.0.0 CWE-79
TI-2021-18022 CVE-2021-41183 · GHSA-j7qv-pgf6-hvh4

XSS in `*Text` options of the Datepicker widget

Priority MEDIUM 40

jQuery-UI is the official jQuery user interface library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.08533 Published 2021-10-26 Partial fix · 1.13.0, 7.0.0 CWE-79
TI-2021-13463 CVE-2021-34429 · GHSA-vjv5-gp2w-65vm

Information disclosure in Eclipse Jetty

Priority HIGH 69

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.9933 Published 2021-07-15 Partial fix · 9.4.43, 10.0.6 +1 CWE-200
TI-2021-13462 CVE-2021-34428 · GHSA-m6cp-vxjx-65j6

Insufficient session expiration in Eclipse Jetty

Priority LOW 19

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager.

CVSS 3.1LOW 3.5 Physical No auth No interaction EPSS 0.00963 Published 2021-06-22 Partial fix · 9.4.41, 10.0.3 +1 CWE-613
TI-2021-09398 CVE-2021-28169 · GHSA-gwcr-j4wh-j3cq

Information disclosure in Eclipse Jetty

Priority MEDIUM 64

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.7848 Published 2021-06-09 Partial fix · 9.4.41, 10.0.3 +1 CWE-200
TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

Priority MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20
TI-2021-09394 CVE-2021-28165 · GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

Priority HIGH 71

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.53861 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-400
TI-2020-16549 CVE-2020-27223 · GHSA-m394-8rww-3jr7

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 64

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.78031 Published 2021-02-26 Partial fix · 9.4.37, 10.0.1 +1 CWE-407
TI-2020-16544 CVE-2020-27218 · GHSA-86wm-rrjm-8wh8

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…

Priority LOW 33

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.08277 Published 2020-11-28 Partial fix · 9.4.35.v20201120 CWE-226
Load more