{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1f4bda1a-97d1-5484-9938-1994224a17b8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-osgi-boot-jsp", "purl": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8.osgi", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-osgi-boot-jsp", "purl": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8.osgi", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3717dad7-e0eb-55bf-b2f6-3a836658efb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4c68ff5c-8428-54a0-9d3f-a5bbccdb8279", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:52a12f7d-76aa-5a56-836f-440f826761ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e7bb5936-acb5-55b6-86fd-d330d8122595", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a43b0ac8-ad22-5cda-a160-43a9f6d97ca7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6fd9ab7d-3b76-5bea-9c81-b0551fa4423b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:449d7ef7-7940-5422-a5a8-5f2dc4fb7b5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4c819d20-9c17-5937-8bec-b5779936938a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:806b03e0-9cc6-5e2d-831f-7d71e3ec67ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3880fcd0-6f45-5e9a-a64a-e84d3b5b3527", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8759edb5-f3ca-55ce-bc02-c7e512578ed5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8cfc6a40-3c98-57c2-bd0d-fc701e1f296b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:45c93a6c-9d18-5032-8ce3-c72dd982a0a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:58f847af-9892-5c61-b682-4f63bee17e80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:878e8fe2-d795-5d1e-b10d-44ef792163ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1dc5803c-6e48-5070-9851-cfdc8c9ff209", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c9c50a4b-f85a-524a-8fa5-014a48dec971", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:45d2ba42-3ac1-5bf0-b84c-3b71358c524b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c5013c9b-7a6d-5d3e-9586-7f7f3378e549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7cf9a81f-991f-5e52-966d-427dac86a368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ac6795d-3f4e-5f58-a97d-a6b327b2b0dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d8ebdb3-7b9a-5026-b4df-c85d49a18c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:64ed5f39-609e-5ee9-9860-1ff010ad1ecf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ab8eaad2-c697-5546-9a30-bfb77e08746b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:030fc83d-dc9a-54ec-b35b-dcefff1c439f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7eef3f2d-028b-5fd2-bd83-cbbdda367492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d94a82c3-5a0b-53b2-bc88-86b63c2259e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f1d3cf91-3671-577c-8881-f4db532248a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:48590e9e-3e73-5d0a-8706-5a59b77c2425", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ef440268-7b3c-5352-8fbe-ddc87651f8c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fb9f61a6-b8ff-57d7-ba6c-62fe54407e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:62e88b42-9cd1-58ee-a80b-075c3e9556de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1d911423-d175-5121-bf56-fffd81f48b7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7fa8d444-60ee-52b1-8b90-30681324a846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d5a37933-f4c4-51cc-a163-9004c7b556e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6ad34f2d-a7a2-5634-96c2-105a75bde9f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9c273707-24ba-5058-8e11-aa23a5cb8ce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9f96444c-8873-5a39-9bbd-24e7053cb29a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d10723e-cb65-5856-aac7-7a2d604b4db7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:37364a76-5865-5838-ba9e-ad90ccce3865", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:054f1c86-f123-5c06-9b36-0094858f6cfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:322e8db6-c488-50e7-8da0-d51bfc27fecf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:adcd3d6f-e372-555e-8e9e-1b98afb6f416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6aac672f-7b5c-5902-9505-7a41bc21e4e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0d089bf5-5d9c-54c0-bca0-0a84bb657f21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2471fd6f-c604-574a-875c-aff68382e1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:35060a69-5dd5-5906-b88b-68b77cd9835e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:25791f52-cfdf-5a3c-bc83-177fbb4cda7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:72eae95c-f2ee-5a90-875f-48c33cdab7a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6908f8c3-742c-55cd-9f53-b588d71b269b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:995a3ec6-e70f-522e-a816-371eb593e9be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8861d435-52fd-544c-ac23-c98908e6e4f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ce2c1ba7-18df-5d8a-8717-098b99ac8de3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1c99a102-fd77-51a3-b1a9-3cad12b4ec31", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8.osgi:jetty-ee8-osgi-boot-jsp 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8.osgi/jetty-ee8-osgi-boot-jsp@12.0.22-tuxcare.1" } ] }