CLEANSTART-2026-RI65917 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context...

CLEANSTART-2026-JX34186 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CLEANSTART-2026-DA44352 In Eclipse Vert

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Vert...

CLEANSTART-2026-HQ91036 In Eclipse Vert

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Vert...

CVE-2021-34429

CVE-2021-34429 POC for CVE-2021-34429 - Eclipse Jetty 11.0.5 Sensitive File Disclosure Using Encoded URIs to access files inside WEB-INF directory Setting up the testing Environment Prequistics: Installing docker and docker-compose on your system For debain based distros ex. Ubuntu, Kali Linux et...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

CVE-2019-17638-Jetty

JETTY The Jetty project is a 100% Java HTTP Server, HTTP Client and Servlet Container from the eclipse foundation http://www.eclipse.org/jetty/ Jetty is open source and is dual licensed using the Apache 2.0 and Eclipse Public License 1.0. You may choose either license when distributing Jetty...

CVE-2018-14324-Exploit

Hacking Eclipse GlassFish - CVE-2018-14324 The description of CVE-2018-14324 does not fully explain the impact of this vulnerability. TLDR you have access to Java Management Extensions JMX via hardcoded admin:admin creds. While impact is listed as " potentially sensitive information, perform...

CVE-2021-34427

CVE-2021-34427 Windows POC for CVE-2021-34427 affecting Birt Viewer Tested on Birt 4.8.0 Built with Claude Based on research here: https://bugs.eclipse.org/bugs/showbug.cgi?id=538142&ref=labs.watchtowr.com & https://sploitus.com/exploit?id=PACKETSTORM:170326...

CVE-2020-14368

CSWSH-THEIA-CVE-2020-14368 Report target: Eclipse CHE deployment available on che.openshift.io Vulnerability type: Cross-site websocket hijack Discovery date: 2020-04-08 Author: Robin Duda codingchili@github Summary The /services websocket endpoint in Eclipse CHE adn Theia is vulnerable to...

CVE-2026-2587-Exploit-POC

CVE-2026-2587 Exploit PoC — Eclipse GlassFish EL Injection RCE Validator Safe PoC validator for CVE-2026-2587, a critical EL Injection / RCE issue affecting Eclipse GlassFish admin console gadget handling via /common/gadgets/gadget.jsf. This tool helps security teams validate GlassFish...

Eclipse Theia - Unauthenticated Path Traversal

Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscodebat plugin identifier...

Eclipse Mojarra - Local File Read

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. id: CVE-2020-6950 info: name: Eclipse Mojarra - Local File Read author: iamnoooob,pdresearch severity: medium description: | Directory traversal in Eclipse Mojarra...

Eclipse BIRT Viewer - Remote Code Execution

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters. id: CVE-2021-34427 info: name: Eclipse BIRT Viewer - Remote Code...

Eclipse Jetty ConcatServlet - Information Disclosure

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

CVE-2026-97891

In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints /admin/auth, /admin/login/password, /admin/login/cert before checking the HTTP method, parsing the request, or validating any submitted credentials, and...

CVE-2026-112185

In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 org.eclipse.kura.rest.configuration.provider does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API is vulnerable to denial of service due to improper handling of JSON request bodies. The API reads the JSON body into memory without size limits and performs parsing before authenticating the caller. A remote attacker ca...

EUVD-2026-121410

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...