Eclipse
Page 2 of 3 — Eclipse CVEs from a corpus of 295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1007 | Medium | 5.3 | 2025-02-19 | In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a name… |
CVE-2024-10917 | Low | 3.7 | 2024-11-11 | In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is corre… |
CVE-2024-3935 | Medium | 6.5 | 2024-10-30 | In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connectio… |
CVE-2024-10525 | Critical | 9.8 | 2024-10-30 | In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6763 | Low | 3.7 | 2024-10-14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The Htt… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-8376 | High | 7.5 | 2024-10-11 | In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of… |
CVE-2024-9329 | Medium | 6.1 | 2024-09-30 | In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpo… |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-8646 | Medium | 6.1 | 2024-09-11 | In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (C… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-8391 | High | 7.5 | 2024-09-04 | In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.ve… |
CVE-2023-7272 | High | 8.6 | 2024-07-17 | In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and d… |
CVE-2024-3933 | Medium | 5.3 | 2024-05-27 | In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.ar… |
CVE-2024-5165 | Medium | 6.5 | 2024-05-23 | In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-i… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-0740 | Critical | 9.8 | 2024-04-26 | Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authent… |
CVE-2024-3046 | High | 7.5 | 2024-04-09 | In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to re… |
CVE-2024-2452 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an alloc… |
CVE-2024-2214 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected… |
CVE-2024-2212 | High | 7.3 | 2024-03-26 | In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeR… |
CVE-2024-22201 | High | 7.5 | 2024-02-26 | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attack… |
CVE-2023-6194 | Low | 2.8 | 2023-12-11 | In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to extern… |
CVE-2023-48698 | Medium | 6.8 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48697 | Medium | 6.4 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48696 | Medium | 6.7 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48695 | High | 7.3 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48694 | Medium | 6.8 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-5676 | Medium | 4.1 | 2023-11-15 | In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM… |
CVE-2023-4218 | Medium | 5.0 | 2023-11-09 | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any ev… |
CVE-2023-4043 | Medium | 5.9 | 2023-11-03 | In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support… |
CVE-2023-5763 | Medium | 6.8 | 2023-11-03 | In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the… |
CVE-2023-5632 | High | 7.5 | 2023-10-18 | In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, w… |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-3592 | Medium | 5.8 | 2023-10-02 | In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types. |
CVE-2023-0809 | Medium | 5.8 | 2023-10-02 | In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. |
CVE-2023-4760 | High | 7.6 | 2023-09-21 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reas… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-40167 | Medium | 5.3 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the con… |
CVE-2023-36479 | Low | 3.5 | 2023-09-15 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have t… |
CVE-2023-4759 | High | 8.8 | 2023-09-12 | Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git re… |
CVE-2023-28366 | High | 7.5 | 2023-09-01 | The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with dupl… |
CVE-2023-41034 | Medium | 6.5 | 2023-08-31 | Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectL… |
CVE-2023-2597 | High | 7.0 | 2023-05-22 | In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not p… |
CVE-2023-32081 | Medium | 6.5 | 2023-05-12 | Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4… |
CVE-2023-26049 | Low | 2.4 | 2023-04-18 | Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or othe… |
CVE-2023-26048 | Medium | 5.3 | 2023-04-18 | Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `H… |
CVE-2023-0100 | High | 8.8 | 2023-03-15 | In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the rep… |
CVE-2023-24815 | Medium | 4.8 | 2023-02-09 | Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files usi… |
CVE-2022-2712 | Medium | 6.5 | 2023-01-27 | In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. S… |
CVE-2022-36022 | Medium | 5.3 | 2022-11-10 | Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearnin… |
CVE-2022-39368 | High | 8.2 | 2022-11-10 | Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Calif… |
CVE-2022-3676 | Medium | 6.5 | 2022-10-24 | In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to acc… |
CVE-2022-39293 | High | 8.6 | 2022-10-13 | Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [… |
CVE-2022-36063 | High | 7.6 | 2022-10-10 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–su… |
CVE-2022-25897 | Medium | 5.9 | 2022-09-08 | The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption… |
CVE-2022-2838 | Medium | 5.3 | 2022-08-16 | In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection… |
CVE-2022-2576 | High | 7.5 | 2022-07-29 | In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without u… |
CVE-2015-8031 | Critical | 9.8 | 2022-07-18 | Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks. |
CVE-2021-41037 | Critical | 10.0 | 2022-07-08 | In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoin… |
CVE-2022-2191 | High | 7.5 | 2022-07-07 | In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in cas… |
CVE-2022-2048 | High | 7.5 | 2022-07-07 | In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning… |
CVE-2022-2047 | Low | 2.7 | 2022-07-07 | In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme UR… |
CVE-2021-41042 | Medium | 5.3 | 2022-07-07 | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This… |
CVE-2022-29246 | Critical | 9.8 | 2022-05-24 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introdu… |
CVE-2022-29223 | High | 7.5 | 2022-05-24 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing th… |
CVE-2021-38443 | Medium | 6.6 | 2022-05-05 | Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser. |
CVE-2021-38441 | Medium | 6.6 | 2022-05-05 | Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML par… |
CVE-2021-41041 | Medium | 5.3 | 2022-04-27 | In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a Meth… |
CVE-2022-0673 | Medium | 6.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal. |
CVE-2022-0672 | Medium | 5.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run u… |
CVE-2021-41040 | High | 7.5 | 2022-02-01 | In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data. |
CVE-2021-41039 | High | 7.5 | 2021-12-01 | In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, l… |
CVE-2021-41038 | Medium | 6.1 | 2021-11-10 | In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage(). |
CVE-2021-41036 | Critical | 9.8 | 2021-11-03 | In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket. |
CVE-2021-41035 | Critical | 9.8 | 2021-10-25 | In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. |
CVE-2021-41034 | High | 8.1 | 2021-09-29 | The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such… |
CVE-2021-41033 | High | 8.1 | 2021-09-13 | In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using… |
CVE-2021-32835 | Critical | 9.9 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lea… |
CVE-2021-32834 | High | 8.2 | 2021-09-09 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can… |
CVE-2021-34436 | Critical | 9.8 | 2021-09-02 | In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extens… |
CVE-2021-34435 | High | 8.8 | 2021-09-01 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it i… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2020-18735 | High | 7.5 | 2021-08-23 | A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. |
CVE-2020-18734 | High | 7.5 | 2021-08-23 | A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. |
CVE-2021-34433 | High | 7.5 | 2021-08-20 | In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without veri… |
CVE-2021-34432 | High | 7.5 | 2021-07-27 | In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0. |
CVE-2021-34431 | Medium | 6.5 | 2021-07-22 | In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory le… |
CVE-2021-34429 | Medium | 5.3 | 2021-07-15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF… |
CVE-2021-34430 | High | 7.5 | 2021-07-08 | Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then de… |
CVE-2021-34427 | Critical | 9.8 | 2021-06-25 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir)… |
CVE-2021-34428 | Low | 2.9 | 2021-06-22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID i… |
CVE-2021-28169 | Medium | 5.3 | 2021-06-09 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected res… |
CVE-2020-6950 | Medium | 6.5 | 2021-06-02 | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
CVE-2021-28170 | Medium | 5.3 | 2021-05-26 | In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if the… |
CVE-2021-28168 | Medium | 6.2 | 2021-04-22 | Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createT… |
CVE-2021-28167 | Medium | 6.5 | 2021-04-21 | In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entri… |