CVE-2019-10246: Exposure of Sensitive Information Due to Incompatible Policies

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted t...

CVE-2019-10241: Improper Neutralization of Input During Web Page Generation

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents...

CVE-2019-10247: Exposure of Sensitive Information Due to Incompatible Policies

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

Code injection

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

CVE-2019-10245

CVE-2019-10245 affects Eclipse OpenJ9 where the Java bytecode verifier could allow a method to run past the end of a bytecode array, potentially crashing the JVM. The issue is fixed in OpenJ9 release 0.14.0 and later, which correctly rejects the problematic class load. Public references in the pr...

CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Insight (CVE-2018-3180, CVE-2018-12547)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Cognos Insight. These issues were disclosed as part of the IBM Java SDK updates in October 2018 and January 2019. Vulnerability Details If you run your own Java code using the IBM Java Runtime...

CVE-2019-10245: Improper Input Validation

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

PT-2019-11656

Name of the Vulnerable Software and Affected Versions: Eclipse OpenJ9 versions prior to 0.14.0 Oracle Java SE affected versions not specified Description: The issue involves incorrect handling in the Java bytecode verifier, allowing a method to execute past the end of the bytecode array, which ca...

PT-2019-3889

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16 Description The issue is related to the exposure of the fully qualified Base Resource directory name on Windows to a remote client when the server is configured to show a listing of directory...

PT-2019-3873

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 7.x through 9.4.16 Description The issue is related to the lack of protection for service data in the Eclipse Jetty servlet container. This can allow a remote attacker to disclose protected information. Specifically, in...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 7, 7.1, 8 that are used by AIX. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java Technology Edition Version...

Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

GHSA-JWQM-C9F2-2CQ3 Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

Eclipse Kura XML Injection Vulnerability

Eclipse Kura is the Eclipse Foundation's framework for OSGi-based M2M service gateway applications. Eclipse Kura has an xml injection vulnerability that can be exploited by an attacker to obtain sensitive information...

Eclipse Kura Directory Traversal Vulnerability

Eclipse kura is a set of IOT GateWay development framework. Eclipse Kura suffers from a directory traversal vulnerability that can be exploited by an attacker to obtain sensitive information...

Eclipse Kura Information Disclosure Vulnerability

Eclipse Kura is the Eclipse Foundation's framework for OSGi-based M2M service gateway applications. An information disclosure vulnerability exists in Eclipse Kura 4.0.0 and prior versions, which arises from errors such as configuration during operation of a networked system or product. An attacke...