Vendor
Eclipse Foundation
321 known vulnerabilities.
Products
127 results · Clear filters · Feed
-
Medium 6.3
Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an o…
-
Medium 6.9
The FTP client trusts arbitrary IP addresses in the PASV server response
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the cli…
-
Medium 6.9
TFTP client and server copy the ERROR packet message without bounding the read against the packet
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFT…
-
Medium 5.3
DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client rea…
-
Medium 6.3
NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's…
-
Medium 6.3
Out-of-bounds read in the NetX Secure DTLS ClientHello parser
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS server's ClientHello parser reads the session ID, cookie and ciphersuite list without bounding them by the bytes remaining in the messa…
-
Medium 6.9
Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain ac…
-
Medium 6.3
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_sec…
-
Medium 4.8
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops a…
-
Medium 6.3
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
-
Medium 4.3
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limit…
-
Medium 6.3
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint pass…
-
Medium 6.8
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length…
-
Medium 5.3
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URL…
-
Medium 6.0
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storag…
-
Medium 5.7
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
-
Medium 5.7
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` re…
-
Medium 4.6
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 an…
-
Medium 6.9
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An a…
-
Medium 6.9
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation f…
-
Medium 6.9
Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.
-
Medium 5.7
Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
-
Medium 5.8
Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.
-
Medium 4.3
Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypa…
-
Medium 5.3
Eclipse Jetty: Path parameter traversal
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it…
-
Medium 5.3
Eclipse Jetty: HTTP Authority/Host mismatch
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it i…
-
Medium 6.9
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent requ…
-
Medium 6.3
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line,…
-
Medium 4.3
Databroker 0.6.1 PublishValue missing data_point panic
In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server direc…
-
Medium 4.1
In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/…
-
Medium 6.9
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled…
-
Medium 6.9
Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in…
-
Medium 4.1
Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Conten…
-
Medium 6.7
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce t…
-
Medium 5.2
In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interfa…
-
Medium 6.9
Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid…
-
Medium 6.9
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all suppo…
-
Medium 4.2
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. …
-
Medium 6.3
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for exa…
-
Medium 6.3
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').