Total
64 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-40167 | 2 Debian, Eclipse | 2 Debian Linux, Jetty | 2024-11-21 | N/A | 5.3 MEDIUM |
| Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. | |||||
| CVE-2022-2714 | 1 Rosariosis | 1 Rosariosis | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. | |||||
| CVE-2021-38445 | 1 Objectcomputing | 1 Opendds | 2024-11-21 | 7.5 HIGH | 7.0 HIGH |
| OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code. | |||||
| CVE-2024-47293 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | N/A | 7.5 HIGH |
| Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability. | |||||