CVE-2020-12821

Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack...

Security Bulletin: A vulnerability in the IBM Java Runtime affects IBM Rational ClearQuest (CVE-2020-2654)

Summary There is a vulnerability in the IBM® Runtime Environment Java™ Versions 7 and 8, which are used by IBM Rational ClearQuest. This issue was disclosed as part of the IBM Java SDK updates in January 2020 deferred from Oracle Jan 2020 CPU. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTIO...

The vulnerability of the Eclipse OpenJ9 virtual machine, related to errors in access control for diagnostic operations, allows attackers to escalate their privileges.

The vulnerability of the Eclipse OpenJ9 virtual machine is related to errors in access control for diagnostic operations. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Low: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 3.9.1 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications...

eclipse.1072660.n5.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1182290 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Security Bulletin: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. IBM Rational Performance Tester is affected by this vulnerability.

Summary Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of chunked transfer-encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct...

Security Bulletin: Multiple vulnerabilities in IBM Java shipped with IBM Transformation Extender Advanced (CVE-2018-1656, CVE-2018-12539)

Summary There are multiple vulnerabilities in IBM Java shipped with IBM Transformation Extender Advanced. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java DTFJ IBM SDK, Java...

Security Bulletin: Vulnerabiliity in IBM Java shipped with IBM Transformation Extender Advanced (CVE-2018-12547)

Summary A widely used function in the OpenJ9 JVM is vulnerable to buffer overlows. Multiple Java Runtime components use the vulnerable code, so the issue can manifest in a number of different ways. The fix ensures that the buffer cannot overflow. The vulnerability has been addressed. Vulnerabilit...

mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications...

Moderate: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 3.9.0 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

Denial Of Service (DoS)

Eclipse Mosquitto is vulnerable to denial of service DoS. It is possible when a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, leading to an unreachable assert and quiting the Mosquitto...

Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer

Summary Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct...

Moderate: Red Hat Security Advisory: Red Hat CodeReady Workspaces 2.1.0 release

Red Hat CodeReady Workspaces 2.1.0 has been released. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in th...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Performance Management. IBM Performance Management has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-11772 DESCRIPTION: In Eclipse OpenJ9 prior to 0.15, the String.getBytesint, int,...

The vulnerability of the Eclipse Mosquitto messaging broker, related to insufficient checking of exclusive states, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6.0, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment's Diagnostic...

Cross-site Scripting (XSS)

eclipse-emf is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted Eclipse Help URL...

Fedora: Security Advisory for eclipse-pydev (FEDORA-2020-1d0635bd71)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...