Eclipse Lyo 代码问题漏洞

Eclipse Lyo is an integrated development environment from the Eclipse Foundation. A security vulnerability exists in Eclipse Lyo versions 1.0.0 through 4.1.0, which stems from initializing TransformerFactory with a default value that does not restrict DTD loading when using RDF/XML, and can be...

Eclipse Jetty 安全漏洞

Eclipse Jetty is an open source, Java-based Web server and Java Servlet container from the Eclipse Foundation. A security vulnerability exists in Eclipse Jetty, which stems from a pooled ByteBuffer that is not freed by SslConnection, and affects the following products and versions: versions 10.0....

PT-2022-6209

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.0 through 9.4.46 Eclipse Jetty versions 10.0.0 through 10.0.9 Eclipse Jetty versions 11.0.0 through 11.0.9 Description The parsing of the authority segment of an http scheme URI in the Jetty HttpURI class improperly...

Eclipse Jetty 输入验证错误漏洞

Eclipse Jetty is an open source, Java-based Web server and Java Servlet container from the Eclipse Foundation. A security vulnerability exists in Eclipse Jetty that stems from invalid URI parsing that could result in an invalid HttpURI.authority, which affects the following products and releases:...

PT-2022-6935 · Eclipse +3 · Eclipse Jetty +3

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions prior to 9.4.47 Eclipse Jetty versions prior to 10.0.10 Eclipse Jetty versions prior to 11.0.10 Description: The issue arises from the incorrect handling of invalid HTTP/2 requests by the Eclipse Jetty HTTP/2 server...

CVE-2021-41042: Improper Restriction of XML External Entity Reference

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

CVE-2022-2191: Improper Resource Shutdown or Release

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths...

CVE-2022-2047: Improper Input Validation

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario...

CVE-2022-2048: Insufficient Resource Pool

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources lef...

PT-2022-11361

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 1.0.0 through 4.1.0 Description The issue arises from a TransformerFactory being initialized with defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be...

Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues

Summary Multiple issues were identified in versions of Eclipse Jetty that IBM MQ uses to provide Web Console, REST API, Salesforce Bridge and Blockchain bridge functionality. Vulnerability Details CVEID: CVE-2021-28169 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple Java Vulnerabilities Affect IBM Connect:Direct Web Services

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Connect:Direct Web Services. These issues were disclosed as part of the IBM Java SDK updates in May 2019 Vulnerability Details CVE-ID: CVE-2019-10246 Description: Eclipse...

Security Bulletin: Java Vulnerability Affects IBM Sterling Connect:Direct Browser User Interface (CVE-2019-10241, CVE-2019-10246 & CVE-2019-10247)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Sterling Connect:Direct Browser User Interface. These issues were disclosed as part of the IBM Java SDK updates in May 2018 and Jetty Server update in May 2019. Vulnerability Detai...

Moderate: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.2.7 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

Malicious code in eclipse-megamovie-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba2356f6a8ba212a3d5eee25224210fb11bdffca6d71c7dbd919d78b8f97f25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2657 Malicious code in eclipse-megamovie-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba2356f6a8ba212a3d5eee25224210fb11bdffca6d71c7dbd919d78b8f97f25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-tslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 403cf9d76377779542a223381529382a497637bc7c00872159c4fd25b71bf85f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eclipse-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bf751fbca5018142912182836517f51e4336ddd8be19c986cac4528f5471be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2659 Malicious code in eclipse-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bf751fbca5018142912182836517f51e4336ddd8be19c986cac4528f5471be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring Tools 4.15.1 released

Dear Spring Community, I am happy to announce the 4.15.1 release of the Spring Tools 4 for Eclipse, Visual Studio Code, and Theia. fixes and improvements Spring Boot fixed: VScode incorrectly suggests removing @Autowired annotation from methods 787 Spring Boot fixed: VScode quick fix should not...