ch.epfl.scala:bsp4j (=2.2.0-M4.TEST), com.github.davidmoten.xuml-compiler.examples:simple (>=0.5.1 <=0.5.3) +671 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.core.runtime (>=3.12.0 <=3.27.0)

org.eclipse.platform:org.eclipse.core.runtime MAVEN version =3.12.0, =0.5.1, =0.5.1, =0.5.1, =4.0.0-beta1, =0.0.1, =1.2.1, =1.0.33, =2.0.1, =2023.1, =1.2.3, =2.0.0, =3.0.0 - com.github.tsantalis:refactoring-miner =2.4.0 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-XCPC-9JW8...

GHSA-J24H-XCPC-9JW8 Eclipse IDE XXE in eclipse.platform

Impact xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch. Vulnerablility was found by static code analysis SonarLint...

net.enilink.komma:net.enilink.komma.common.ui.rcp (>=1.4.0 <=1.7.4), net.enilink.komma:net.enilink.komma.edit.ui.feature (>=1.4.2 <=1.7.4) +69 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.ui.ide (>=3.13.0 <=3.21.0)

org.eclipse.platform:org.eclipse.ui.ide MAVEN version =3.13.0, =1.4.0, =1.4.2, =1.4.0, =1.4.2, =1.4.0, =1.3.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.0 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-XCPC-9JW8...

com.github.rebue.mbgx:mbgx (>=1.2.1 <=1.2.4), org.eclipse.jdt:org.eclipse.jdt.apt.ui (=3.8.0) +19 more potentially affected by CVE-2023-4218 via org.eclipse.jdt:org.eclipse.jdt.ui (>=3.16.0 <=3.29.0)

org.eclipse.jdt:org.eclipse.jdt.ui MAVEN version =3.16.0, =1.2.1, =1.5.200, =1.1.0, =3.12.900, =1.4.200, =3.15.100, =1.2.800, =1.0.100, =3.13.700, =3.7.800, =3.8.0 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-XCPC-9JW8...

net.enilink.komma:net.enilink.commons.ui (>=1.5.2 <=1.7.4), net.enilink.komma:net.enilink.komma.common.ui (>=1.5.2 <=1.7.4) +109 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.urischeme (>=1.1.0 <=1.3.0)

org.eclipse.platform:org.eclipse.urischeme MAVEN version =1.1.0, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.7.4 - org.eclipse.emfatic:org.eclipse.gymnast.runtime.core =1.0.0 - org.eclipse.jdt:org.eclipse.jdt =3.19.100 -...

com.diffplug.durian:durian-swt (>=3.0.0 <=5.2.0), com.diffplug.durian:durian-swt.cocoa.macosx.aarch64 (>=3.6.1 <=5.2.0) +179 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.jface (>=3.12.2 <=3.30.0)

org.eclipse.platform:org.eclipse.jface MAVEN version =3.12.2, =3.0.0, =3.6.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.31, =1.0.0, =1.0.0, =0.1.0, =1.0.1 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-XCPC-9JW8...

Eclipse IDE XXE in eclipse.platform

Impact xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file for example for review a foreign repository or patch. Vulnerablility was found by static code analysis SonarLint...

de.cau.cs.kieler.klighd:de.cau.cs.kieler.klighd (=2.3.0.v20230606), de.cau.cs.kieler.klighd:de.cau.cs.kieler.klighd.ide (=2.3.0.v20230606) +136 more potentially affected by CVE-2023-4218 via org.eclipse.platform:org.eclipse.ui.workbench (>=3.108.3 <=3.129.0)

org.eclipse.platform:org.eclipse.ui.workbench MAVEN version =3.108.3, =0.50.0.v20230607, =1.4.0, =1.4.0, =1.6.0, =1.4.0, =1.4.2, =1.4.0, =1.4.0, =1.6.0, =1.5.3, =1.7.4 and more Source cves: CVE-2023-4218 Source advisory: OSV:GHSA-J24H-X...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2023:4614-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4614-1 advisory. - Update to Java 8.0 Service Refresh 8 Fix Pack 15: Oracle October 17 2023 CPU bsc1216640 Security fixes: - CVE-2023-22081: Fixed...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 has addressed security vulnerabilities

Summary IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 resolves vulnerabilities reported in the Node.js August 2023 Security Releases as well as vulnerabilities in Apache POI, Apache Shiro, Apache Commons Net, Apache Commons Codec, Eclipse Jetty, Netty, Python and Snappy-Java.Please refer to t...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Eclipse Jetty

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Eclipse Jetty. Vulnerability Details CVEID: CVE-2023-36479 DESCRIPTION: Eclipse Jetty could provide weaker than expected security, caused by an errant command quoting flaw in the...

Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime

Summary This bulletin covers all applicable Java SE CVEs published by OpenJDK as part of their October 2023 Vulnerability Advisory, plus CVE-2023-4807 and CVE-2023-5676. For more information please refer to OpenJDK's October 2023 Vulnerability Advisory and the X-Force database entries referenced...

Security Bulletin: IBM InfoSphere Information Server is affected by Eclipse Jetty vulnerability (CVE-2023-36478)

Summary A vulnerability in Eclipse Jetty used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-36478 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an integer overflow and buffer allocation in MetaDataBuilder.checkSize. By sendin...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Eclipse Jetty

Summary Multiple vulnerabilities in Eclipse Jetty used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2023-36479 DESCRIPTION: Eclipse Jetty could provide weaker than expected security, caused by an errant command quoting flaw in the...

SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-32bit / java-1_8_0-ibm-alsa / etc (SUSE-SU-2023:4572-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4572-1 advisory. - Update to Java 8.0 Service Refresh 8 Fix Pack 15: Oracle October 17 2023 CPU bsc1216640 Security fixes: -...

Security Bulletin: Rational Service Tester contains vulnerabilities which could affect Eclipse Jetty.

Summary Due to use of Eclipse Jetty, Rational Service Tester contains a vulnerability around nonstandard cookie parsing that could allow access to sensitive information, and a vulnerability that could lead to a potential denial of service attack. Vulnerability Details CVEID: CVE-2023-26048...

Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect Eclipse Jetty.

Summary Due to the use of Eclipse Jetty, Rational Performance Tester contains a vulnerability around nonstandard cookie parsing that could allow access to sensitive information, and a vulnerability that could lead to a potential denial of service attack. Vulnerability Details CVEID: CVE-2023-2604...

Security Bulletin: IBM Integration Bus is vulnerable to multiple vulnerabilities in Eclipse Jetty. (CVE-2023-40167, CVE-2023-26049, CVE-2022-2047, IBM X-Force ID: 261776)

Summary IBM Integration Bus is vulnerable to multiple vulnerabilities in Eclipse Jetty. CVE-2023-40167, CVE-2023-26049, CVE-2022-2047, IBM X-Force ID: 261776 Vulnerability Details CVEID: CVE-2023-40167 DESCRIPTION: Jetty is vulnerable to HTTP request smuggling, caused by improper parsing of the...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Browser User Interface uses Eclipse Jetty server. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to server-side request forgery due to Eclipse Jetty (261776)

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By sending a specially...