4945 matches found
CVE-2021-28162
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run...
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
CVE-2021-28161
The CVE-2021-28161 entry concerns Eclipse Theia prior to or including version 1.8.0, where the debug console does not escape HTML. This lack of escaping enables injection of arbitrary JavaScript code through the console, constituting a cross-site scripting risk. The vulnerability is tied to Theia...
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
PT-2021-17784
Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions up to and including 0.16.0 Description: The issue concerns the lack of HTML escaping in notification messages, allowing Javascript code to run. Recommendations: For Eclipse Theia versions up to and including 0.16.0,...
PT-2021-17783
Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions up to and including 1.8.0 Description: The issue concerns the lack of HTML escaping in the debug console, allowing arbitrary Javascript code to be injected. Recommendations: For Eclipse Theia versions up to and includin...
CVE-2021-28162: Inclusion of Web Functionality from an Untrusted Source
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run...
CVE-2021-28161: Improper Neutralization of Input During Web Page Generation
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
Eclipse Theia cross-site scripting vulnerabilities
Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A cross-site scripting vulnerability exists in Eclipse Theia 1.8.0 and prior versions, which stems from the absence of HTML escaping...
Eclipse Theia injection vulnerability
Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. An injection vulnerability exists in Eclipse Theia 0.16.0 and earlier versions, which stems from the absence of HTML escaping in...
DOS vulnerability for Quoted Quality CSV headers
Impact When Jetty handles a request containing request headers with a large number of “quality” i.e. q parameters such as what are seen on the Accept, Accept-Encoding, and Accept-Language request headers, the server may enter a denial of service DoS state due to high CPU usage while sorting the...
Eclipse Platform Unauthorized Access Vulnerability
Eclipse Platform is Eclipse open source defines a set of frameworks and public services that together form the infrastructure needed to support the use of Eclipse as a component model , Rich Client Platform RCP and a comprehensive tool integration platform . Project model for managing resources ,...
CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
UBUNTU-CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
Design/Logic Flaw
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
CVE-2020-27225
CVE-2020-27225 affects the Eclipse Platform (versions 4.18 and earlier). The vulnerability stems from the Help Subsystem not authenticating active help requests to the local help web server, allowing a local, unauthenticated attacker to issue active help commands to the Eclipse Platform process o...
CVE-2020-27225
In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...
