PT-2022-6209 · Eclipse +2 · Eclipse Jetty +2

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions 9.4.0 through 9.4.46 Eclipse Jetty versions 10.0.0 through 10.0.9 Eclipse Jetty versions 11.0.0 through 11.0.9 Description: The parsing of the authority segment of an http scheme URI in the Jetty HttpURI class improperl...

PT-2022-6935 · Eclipse +3 · Eclipse Jetty +3

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions prior to 9.4.47 Eclipse Jetty versions prior to 10.0.10 Eclipse Jetty versions prior to 11.0.10 Description: The issue arises from the incorrect handling of invalid HTTP/2 requests by the Eclipse Jetty HTTP/2 server...

Eclipse Jetty 输入验证错误漏洞

Eclipse Jetty is an open source, Java-based Web server and Java Servlet container from the Eclipse Foundation. A security vulnerability exists in Eclipse Jetty that stems from invalid URI parsing that could result in an invalid HttpURI.authority, which affects the following products and releases:...

Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues

Summary Multiple issues were identified in versions of Eclipse Jetty that IBM MQ uses to provide Web Console, REST API, Salesforce Bridge and Blockchain bridge functionality. Vulnerability Details CVEID: CVE-2021-28169 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive...

Security Bulletin: Java Vulnerability Affects IBM Sterling Connect:Direct Browser User Interface (CVE-2019-10241, CVE-2019-10246 & CVE-2019-10247)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Sterling Connect:Direct Browser User Interface. These issues were disclosed as part of the IBM Java SDK updates in May 2018 and Jetty Server update in May 2019. Vulnerability Detai...

Security Bulletin: Multiple Java Vulnerabilities Affect IBM Connect:Direct Web Services

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Connect:Direct Web Services. These issues were disclosed as part of the IBM Java SDK updates in May 2019 Vulnerability Details CVE-ID: CVE-2019-10246 Description: Eclipse...

Moderate: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.2.7 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

MAL-2022-2657 Malicious code in eclipse-megamovie-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba2356f6a8ba212a3d5eee25224210fb11bdffca6d71c7dbd919d78b8f97f25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-megamovie-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba2356f6a8ba212a3d5eee25224210fb11bdffca6d71c7dbd919d78b8f97f25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-tslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 403cf9d76377779542a223381529382a497637bc7c00872159c4fd25b71bf85f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bf751fbca5018142912182836517f51e4336ddd8be19c986cac4528f5471be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2659 Malicious code in eclipse-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bf751fbca5018142912182836517f51e4336ddd8be19c986cac4528f5471be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring Tools 4.15.1 released

Dear Spring Community, I am happy to announce the 4.15.1 release of the Spring Tools 4 for Eclipse, Visual Studio Code, and Theia. fixes and improvements Spring Boot fixed: VScode incorrectly suggests removing @Autowired annotation from methods 787 Spring Boot fixed: VScode quick fix should not...

Design/Logic Flaw

SAP NetWeaver Developer Studio NWDS - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x...

CVE-2022-29615

SAP NetWeaver Developer Studio NWDS - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x...

Security Bulletin: IBM Sterling Control Center is vulnerable to remote attacker security restrictions bypass due to Eclipse EE4J Jakarta Expression Language (CVE-2021-28170)

Summary Eclipse EE4J Jakarta Expression Language is used by IBM Sterling Control Center. Eclipse EE4J Jakarta Expression Language could allow a remote attacker to bypass security restrictions, and the issue has been addressed. Vulnerability Details CVEID: CVE-2021-28170 DESCRIPTION: Eclipse EE4J...

java-11-openj9,java-1_8_0-openj9: unverified methods can be invoked using MethodHandles

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles...

Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway uses Eclipse Jetty with multiple known vulnerabilities

Summary Vulnerabilities contained within Eclipse Jetty a 3rd party component were identified and remediated in the IBM MaaS360 Mobile Enterprise Gateway MEG. Vulnerability Details CVEID:CVE-2021-28169 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Multiple Eclipse Jetty vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2021-28169 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the...

The vulnerability of the MQTT v5 broker implementation in the Eclipse Mosquitto protocol allows a attacker to trigger a service failure.

The vulnerability of the MQTT v5 broker implementation in Eclipse Mosquitto lies in excessive loading of the central processor. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...