Security Vulnerabilities - CVEs Published In October 2024
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI
differs from the common browsers in how it handles a URI that would be
considered invalid if fully validated against the RRC. Specifically HttpURI
and the browser may differ on the value of the host extracted from an
invalid URI and thus a combination of Jetty and a vulnerable browser may
be vulnerable to a open redirect attack or to a SSRF attack if the URI
is used after passing validation checks.
CVSS Score
3.7
EPSS Score
0.01
Published
2024-10-14
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Score
5.9
EPSS Score
0.015
Published
2024-10-14
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.
Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
CVSS Score
8.8
EPSS Score
0.027
Published
2024-10-14
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.
CVSS Score
9.8
EPSS Score
0.006
Published
2024-10-14
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.
CVSS Score
9.8
EPSS Score
0.001
Published
2024-10-14
Jetty PushSessionCacheFilter can be exploited by unauthenticated users
to launch remote DoS attacks by exhausting the server’s memory.
CVSS Score
3.1
EPSS Score
0.006
Published
2024-10-14
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
CVSS Score
7.3
EPSS Score
0.001
Published
2024-10-14
There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
CVSS Score
5.3
EPSS Score
0.006
Published
2024-10-14
Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
CVSS Score
7.3
EPSS Score
0.001
Published
2024-10-14
Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
CVSS Score
9.8
EPSS Score
0.001
Published
2024-10-14