CVE-2019-11776

The CVE-2019-11776 entry affects Eclipse BIRT Report Viewer (versions 1.0–4.7). The underlying issue is a reflected XSS in a URL parameter (notably the __format parameter in the Report Viewer) that allows an attacker to inject JavaScript executed in the victim’s browser context. This is caused by...

CVE-2021-34427

CVE-2021-34427 affects Eclipse BIRT up to version 4.8.0. A JSP-injection flaw lets an attacker, via crafted query parameters, create a JSP file in the remote viewer directory and inject code, enabling remote code execution and potential server compromise. Exploitation details are documented in th...

CVE-2023-0100

CVE-2023-0100 (Eclipse BIRT) affects BIRT versions starting from 2.6.2 where the default configuration allowed retrieval of a report from the same host using an absolute HTTP path in the __report parameter. If the HTTP Host header could be tampered with (e.g., configurations with no virtual hosts...