Skip to content
OpenAdvisories

Vendor

The Eclipse Foundation

107 known vulnerabilities.

Products

Eclipse Jetty 23 Eclipse Mosquitto 16 Eclipse OpenJ9 14 Eclipse Kura 9 Eclipse Vert.x 6 Eclipse Theia 6 Eclipse OMR 3 Eclipse Californium 3 Eclipse BIRT 2 Eclipse Che 2 Eclipse Memory Analyzer 2 Eclipse hawkBit 2 Eclipse Hono 2 Eclipse GlassFish 1 Eclipse TinyDTLS 1 Eclipse Buildship 1 Eclipse Lyo 1 Eclipse Paho 1 Eclipse Paho MQTT C Client 1 Eclipse BIRT (Business Intelligence Reporting Tool) 1 @theia/plugin-ext 1 Eclipse Xtext 1 Eclipse Vorto 1 Eclipse Equinox p2 1 Eclipse Equinox 1 Eclipse Web Tools Platform 1 Eclipse Platform 1 Jakarta Expression Language Implementation 1 Eclipse Jersey 1 Eclipse Sphinx 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2021-41037

    In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoi…

    The Eclipse Foundation Eclipse Equinox p2
  • Critical 9.6
    CVE-2020-27224

    Cross-site Scripting (XSS) in Eclipse Theia

    In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

    The Eclipse Foundation Eclipse Theia @theia/preview npm
  • Critical 9.8
    CVE-2019-17640 Public exploit

    Path Traversal in Eclipse Vert

    In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allo…

    The Eclipse Foundation Eclipse Vert.x io.vertx:vertx-web Maven
  • Critical 9.4
    CVE-2019-17638 Public exploit EPSS 11%

    Operation on a Resource after Expiration or Release in Jetty Server

    In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Maven
  • Critical 9.8
    CVE-2018-12542 Public exploit

    Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location

    In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location th…

    The Eclipse Foundation Eclipse Vert.x io.vertx:vertx-web Maven
  • Critical 9.8
    CVE-2017-7658 EPSS 19%

    Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

    In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked …

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-7657 EPSS 14%

    Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a …

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven