Archive

1 April 2021

Vulnerabilities first published on this day (UTC), newest first.

← March 2021 2021 / April /1 May 2021 →

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.5

CVE-2021-28165 Public exploit EPSS 54%

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven

Apr 1, 2021
Medium 5.3

CVE-2021-28164 Public exploit Scanner template EPSS 82%

Authorization Before Parsing and Canonicalization in jetty

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven

Apr 1, 2021