Vulnerabilidades em The Eclipse Foundation

101 resultados
Análise Vexday

Com 101 CVEs catalogadas e nenhuma incorporada ao catálogo KEV da CISA, o portfólio do The Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças em curso. No entanto, a CVE mais crítica identificada, CVE-2021-34429, concentra atenção: seu score EPSS de 0,993 indica altíssima probabilidade de exploração, tornando-a prioridade imediata de remediação independentemente da ausência de registro formal no KEV. O tipo de falha mais recorrente, CWE-20 (validação imprópria de entrada), é uma categoria estrutural que, quando presente em múltiplas superfícies, tende a facilitar encadeamento de vulnerabilidades. A existência de provas de conceito públicas para duas CVEs reforça a necessidade de monitoramento contínuo, mesmo em um cenário sem novas vulnerabilidades reportadas nos últimos 90 dias.

CVE-2021-34429MEDIUMFor Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the conEPSS 99.3%CVE-2021-28164MEDIUMIn Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segmEPSS 82.4%CVE-2021-28169MEDIUMFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to aEPSS 78.5%CVE-2020-27223MEDIUMIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptEPSS 78.0%CVE-2021-34427—In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curreEPSS 57.7%CVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2018-12543—In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is nEPSS 36.0%CVE-2017-7658—In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when prEPSS 21.0%CVE-2017-7657—In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledEPSS 16.2%CVE-2019-17638—In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produceEPSS 11.1%CVE-2019-10241—In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote clEPSS 9.6%CVE-2020-27218—In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request boEPSS 8.1%CVE-2017-7656—In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabledEPSS 6.2%CVE-2019-10247—In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version EPSS 5.8%CVE-2017-7651—In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large EPSS 5.3%CVE-2018-12545—In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETEPSS 5.1%CVE-2020-27216—In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sysEPSS 4.4%CVE-2018-12536—In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doEPSS 4.3%CVE-2021-28163LOWIn Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,EPSS 4.2%CVE-2019-10246—In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base ResEPSS 4.0%