| Spring Framework vulnerable to Denial of ServiceCVE-2024-38808 · GHSA-9CMQ-M9J5-MVWW |
org.springframework:spring-expressionRed Hat Fuse 7/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache MINA SSHD: integrity check bypassCVE-2024-41909 · GHSA-2326-HX7G-3M9R |
org.apache.sshd:sshd-commonA-MQ Clients 2/sshd-common |
MavenRed Hat |
High
|
Fix reported |
|
| Erroneous authentication pass in Spring SecurityCVE-2024-22257 · GHSA-F3JH-QVM4-MG39 |
org.springframework.security:spring-security-coreOpenShift Developer Tools and Services/jenkins |
MavenRed Hat |
High
|
Fix reported |
|
| Connection leaking on idle timeout when TCP congestedCVE-2024-22201 · GHSA-RGGV-CV7R-MW98 |
org.eclipse.jetty.http2:http2-commonorg.eclipse.jetty.http2:jetty-http2-common |
MavenRed Hat |
High
|
Fix reported |
|
| OutOfMemoryError for large multipart without filename in Eclipse JettyCVE-2023-26048 · GHSA-QW69-RQJ8-6QW8 |
org.eclipse.jetty:jetty-serverOpenShift Serverless/jetty-server |
MavenRed Hat |
Medium
|
Fix reported |
|
| Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookiesCVE-2023-26049 · GHSA-P26G-97M4-6Q7C |
org.eclipse.jetty:jetty-serverMigration Toolkit for Applications 6/jetty-server |
MavenRed Hat |
Low
|
Fix reported |
|
| Encoded URIs can access WEB-INF directory in Eclipse JettyCVE-2021-34429 · GHSA-VJV5-GP2W-65VM |
org.eclipse.jetty:jetty-webappRed Hat Enterprise Linux 7/jetty |
MavenRed Hat |
Medium
|
Fix reported |
|
| Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure VulnerabilityCVE-2021-28169 · GHSA-GWCR-J4WH-J3CQ |
org.eclipse.jetty:jetty-servletsRed Hat Enterprise Linux 7/jetty |
MavenRed Hat |
Medium
|
Fix reported |
|
| Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodiesCVE-2024-34144 · GHSA-V63G-V339-2673 |
org.jenkins-ci.plugins:script-securityRed Hat OpenShift Container Platform 3.11/jenkins-2-plugins |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Commons FileUpload denial of service vulnerabilityCVE-2023-24998 · GHSA-HFRX-6QGJ-FP6C |
commons-fileupload:commons-fileuploadorg.apache.tomcat.embed:tomcat-embed-core |
MavenRed Hat |
High
|
Fix reported |
|
| Jenkins Script Security Plugin sandbox bypass vulnerabilityCVE-2024-34145 · GHSA-2G4Q-9VM9-9FW4 |
org.jenkins-ci.plugins:script-securityRed Hat OpenShift Container Platform 3.11/jenkins-2-plugins |
MavenRed Hat |
High
|
Fix reported |
|
| Path traversal vulnerability in Jenkins Matrix Project PluginCVE-2024-23900 · GHSA-CJGM-9VC9-56MX |
org.jenkins-ci.plugins:matrix-projectRed Hat OpenShift Container Platform 3.11/jenkins-2-plugins |
MavenRed Hat |
Medium
|
Fix reported |
|
| SessionListener can prevent a session from being invalidated breaking logoutCVE-2021-34428 · GHSA-M6CP-VXJX-65J6 |
org.eclipse.jetty:jetty-serverRed Hat Enterprise Linux 7/jetty |
MavenRed Hat |
Low
|
Fix reported |
|
| HTTP/2 Stream Cancellation AttackCVE-2023-44487 · GHSA-QPPJ-FM5R-HXR3 |
golang.org/x/netcom.typesafe.akka:akka-http-core |
GoMavenRed HatSwift |
Medium
|
Fix reported |
|
| Information Disclosure in GuavaCVE-2020-8908 · GHSA-5MG8-W23W-74H3 |
com.google.guava:guavaRed Hat Enterprise Linux 7/guava |
MavenRed Hat |
Low
|
Fix reported |
|
| Arbitrary file read vulnerability through the Jenkins CLI can lead to RCECVE-2024-23897 · GHSA-6F9G-CXWR-Q5JR |
org.jenkins-ci.main:jenkins-coreRed Hat OpenShift Container Platform 3.11/jenkins |
MavenRed Hat |
Critical
|
Fix reported |
|
| HTTP/2 HPACK integer overflow and buffer allocationCVE-2023-36478 · GHSA-WGH7-54F2-X98R |
org.eclipse.jetty.http2:http2-hpackorg.eclipse.jetty.http3:http3-qpack |
MavenRed Hat |
High
|
Fix reported |
|
| Jenkins Remoting library arbitrary file read vulnerabilityCVE-2024-43044 · GHSA-H856-FFVV-XVR4 |
org.jenkins-ci.main:jenkins-coreorg.jenkins-ci.main:remoting |
MavenRed Hat |
High
|
Fix reported |
|
| Information Disclosure in Apache GroovyCVE-2020-17521 · GHSA-RCJJ-H6GH-JF3R |
org.codehaus.groovy:groovy-allorg.codehaus.groovy:groovy |
MavenRed Hat |
Medium
|
Fix reported |
|
| Jenkins temporary uploaded file created with insecure permissionsCVE-2023-43498 · GHSA-HQ87-H4JG-VXFW |
org.jenkins-ci.main:jenkins-coreOpenShift Developer Tools and Services/jenkins |
MavenRed Hat |
Low
|
Fix reported |
|
