Vulnerabilidades em The Eclipse Foundation

101 resultados
Análise Vexday

Com 101 CVEs catalogadas e nenhuma incorporada ao catálogo KEV da CISA, o portfólio do The Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças em curso. No entanto, a CVE mais crítica identificada, CVE-2021-34429, concentra atenção: seu score EPSS de 0,993 indica altíssima probabilidade de exploração, tornando-a prioridade imediata de remediação independentemente da ausência de registro formal no KEV. O tipo de falha mais recorrente, CWE-20 (validação imprópria de entrada), é uma categoria estrutural que, quando presente em múltiplas superfícies, tende a facilitar encadeamento de vulnerabilidades. A existência de provas de conceito públicas para duas CVEs reforça a necessidade de monitoramento contínuo, mesmo em um cenário sem novas vulnerabilidades reportadas nos últimos 90 dias.

CVE-2018-12547—In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affEPSS 2.7%CVE-2019-11779—In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approEPSS 2.7%CVE-2018-12538—In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSesEPSS 2.7%CVE-2018-12541—In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hEPSS 2.7%CVE-2019-10245—In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode arEPSS 2.5%CVE-2018-12537—In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and linEPSS 2.5%CVE-2020-27224—In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.EPSS 2.4%CVE-2018-12549—In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when acEPSS 2.3%CVE-2018-12542—In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restEPSS 2.3%CVE-2022-2048HIGHIn Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noEPSS 2.3%CVE-2021-34436—In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extEPSS 2.2%CVE-2017-7654—In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can sendEPSS 2.2%CVE-2018-12544—In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense EPSS 2.2%CVE-2021-28170—In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be EPSS 2.1%CVE-2019-11772—In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null EPSS 2.1%CVE-2019-17631—From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without aEPSS 2.1%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.1%CVE-2019-17640—In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, EPSS 2.0%CVE-2018-12540—In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form pEPSS 2.0%CVE-2019-10242—In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversEPSS 2.0%