Vulnerabilidades em The Eclipse Foundation

101 resultados
Análise Vexday

Com 101 CVEs catalogadas e nenhuma incorporada ao catálogo KEV da CISA, o portfólio do The Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças em curso. No entanto, a CVE mais crítica identificada, CVE-2021-34429, concentra atenção: seu score EPSS de 0,993 indica altíssima probabilidade de exploração, tornando-a prioridade imediata de remediação independentemente da ausência de registro formal no KEV. O tipo de falha mais recorrente, CWE-20 (validação imprópria de entrada), é uma categoria estrutural que, quando presente em múltiplas superfícies, tende a facilitar encadeamento de vulnerabilidades. A existência de provas de conceito públicas para duas CVEs reforça a necessidade de monitoramento contínuo, mesmo em um cenário sem novas vulnerabilidades reportadas nos últimos 90 dias.

CVE-2021-41036—In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.EPSS 1.2%CVE-2020-27220—The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & conEPSS 1.1%CVE-2018-12548—In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives whichEPSS 1.1%CVE-2021-28167—In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain EPSS 1.1%CVE-2021-41033—In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middEPSS 1.1%CVE-2021-34431—In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to theEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2021-34430—Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the masEPSS 1.0%CVE-2021-41042—In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working EPSS 1.0%CVE-2021-28166MEDIUMIn Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to thEPSS 1.0%CVE-2021-34428LOWFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thEPSS 1.0%CVE-2022-2712MEDIUMIn Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path stEPSS 0.9%CVE-2019-11776—In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's bEPSS 0.9%CVE-2019-17637—In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be explEPSS 0.9%CVE-2021-28168MEDIUMEclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use EPSS 0.9%CVE-2020-27222—In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS serEPSS 0.9%CVE-2023-0100—In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTEPSS 0.8%CVE-2019-11777—In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the resEPSS 0.8%CVE-2020-27219—In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe EPSS 0.8%CVE-2021-41037CRITICALIn Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installatiEPSS 0.8%