CVE-2019-10243

CVE-2019-10243 affects Eclipse Kura up to v4.0.0. The issue is that Kura exposes the underlying Ui Web server version in its replies, which an attacker could use as a hint to craft targeted attacks against the Kura web server. The provided documents do not specify a fixed version or remediation; ...

CVE-2019-10244

CVE-2019-10244 affects Eclipse Kura up to version 4.0.0. The vulnerability points to XXE attacks via the Web UI package and component services, the Artemis simple MQTT component, and the emulator position service (not part of the device distribution) caused by improper factory and parser initiali...

CVE-2019-10243

In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura...

CVE-2019-10242

In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types...

CVE-2019-10244

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

CVE-2019-10242

The provided CVE entry applies to Eclipse Kura up to version 4.0.0, where the SkinServlet did not validate the path parameter in GET requests. This could allow path traversal for a limited set of file types. The vulnerability is described without explicit exploitation details or listed fixes in t...

CVE-2019-10243

In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura...

PT-2019-11653

Name of the Vulnerable Software and Affected Versions: Eclipse Kura versions prior to 4.0.0 Description: The issue concerns a path traversal problem in get requests for a limited number of file types due to the SkinServlet not checking the path passed during servlet calls. Recommendations: For...

CVE-2019-10242: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types...

CVE-2019-10243: Exposure of Sensitive System Information to an Unauthorized Control Sphere

In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura...

PT-2019-11654

Name of the Vulnerable Software and Affected Versions: Eclipse Kura versions up to 4.0.0 Description: The issue allows an attacker to discover the underlying Ui Web server version used by Eclipse Kura, which can be utilized to craft specific attacks against the web server. Recommendations: For...

PT-2019-11655

Name of the Vulnerable Software and Affected Versions: Eclipse Kura versions up to 4.0.0 Description: The issue is related to an improper factory and parser initialization, which could make certain components targets of an XXE attack. The affected components include the Web UI package and compone...

CVE-2019-10244: Improper Restriction of XML External Entity Reference

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations require...

Eclipse Jetty CVE-2019-10241 Cross Site Scripting Vulnerability

Description Eclipse Jetty is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Remote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow...

PT-2019-3890

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.26 and older Eclipse Jetty versions 9.3.25 and older Eclipse Jetty versions 9.4.15 and older Description The server is vulnerable to XSS conditions if a remote client uses a specially formatted URL against the...

CVE-2019-10240

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

CVE-2019-10240

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

Design/Logic Flaw

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

CVE-2019-10240

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...