{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12755c93-c713-5138-984b-7e0d4b8c3ac8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:230506df-a3f0-554a-b2a2-97d26fe14c7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d96a7d03-5b79-5999-abb4-e78228e4c557", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:be35d502-9e96-5d99-a2a8-64b7fda17645", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3659e65f-9dd7-53f7-9852-c4c1a72bd04c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:44d763f3-cfdc-59b3-a4b0-2451b66d3a13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4be38158-79f9-573a-9cd5-655c7d8e9685", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:49d8c45b-0411-5d56-bbfe-55e15ac4661a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e0428127-eb35-575f-90eb-df8291b07e03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e507c2f2-0795-5e6b-b026-a3326801b46d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8fc02ac-17d4-578a-beca-b8620e124db9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1169ab11-cbbb-5807-8461-9f4a7eb33392", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:826027fc-cf81-59ef-90ce-4bd97500d5b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ad0b5e0-0f0c-54c2-b7d5-4ec0cb0ba277", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eebe507b-e2a0-5d2b-90a5-4ff83b94e8ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f21125f7-e4ff-5814-88d2-0a0dacfc31ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:03a6f7a5-8b80-5e79-ace1-40f7fbf68b53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ca8553e3-5d45-5adb-aa8e-02aa0a6098d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:901a7aad-78c3-5bc2-8e8d-6de22e1aa937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:94c7f136-e27a-53b6-9c91-7385007cb87a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:17e1c21a-055d-55fd-9a6a-dbef1510544f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e01b8cea-77c9-5734-a80d-0e1c3d9b52ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:af4d1cbf-ef80-5675-8879-af156ffdd6cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:91ac02f2-8985-5c03-899c-1add2340de18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:40cea4cd-b55e-5f6a-974c-891a18f0f944", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fcbccd2d-a7f0-5b89-ae50-33338fa066fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4bfef35d-899e-5bf1-bb4d-747063b63212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:47744f1d-248e-5917-8904-db167fb3d84c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d57fdf32-2b13-5792-b364-281b797d416b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:15066789-a5f2-5bcb-a678-971f3daa3d7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:42381a85-0013-5af3-be11-c07ec97505c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:66eba720-4cbc-5a22-87ba-a5be0711f2f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:65c2fef8-c942-543f-b7e5-0610dbf131a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2af46d92-d029-5036-9a26-fdcab4922960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22201 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:facbbd6f-b3f1-5ba0-997d-14b94400afce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:103d97fd-d46f-5ac3-93d7-8cb52f2d0a28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ed1ecb5-16ae-5823-bf67-9ac90f4a0794", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:de8b185b-71df-53bd-a98f-cb97424fc87a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d4ac83c2-21a2-568b-a415-7c19d7879d64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2025-1948", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:240299e4-db20-52b5-b4e0-05626c0721e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-1948 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e1b483ad-18e3-5a17-8761-edcf9acc22bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:32a3f2df-f50d-5888-9f21-fa9b807fadef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:41b93081-2a44-597a-8428-de521e612ef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46676356-8d73-5e3d-8092-8040105f36ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:961ccb94-76ea-53d8-a72f-db2582304f93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:616c016f-f6a9-5672-b45b-09940de64f6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:52d399fd-19e8-56fc-a9ac-c202c8f9b5cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:55d48cf5-acd1-5641-812a-d9cf133c4266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fa5cf811-31d9-5543-98af-ce76f02b6667", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c70f6179-8389-5d44-9ff0-e877c7f701da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:70594941-b492-53bd-ae5a-0403b9c86e3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:77a317a2-1657-541f-8192-275ddb7426f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:22648428-e568-55a9-963d-3dfc994e8ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:df90a799-2872-5cdb-b8e4-b72be07ef6ed", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-webapp." } }, { "id": "GHSA-gc59-r5jq-98qw", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6e3f7c53-46a1-5c8e-b108-9e8b6c5380a3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-gc59-r5jq-98qw is a false positive for org.eclipse.jetty.ee8:jetty-ee8-webapp 12.0.22-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-webapp@12.0.22-tuxcare.1" } ] }