Vulnerabilities > Eclipse
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-09-19 | CVE-2019-11779 | Uncontrolled Recursion vulnerability in multiple products In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. | 6.5 |
| 2019-09-18 | CVE-2019-11778 | Use After Free vulnerability in Eclipse Mosquitto If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations. | 5.4 |
| 2019-09-12 | CVE-2019-11774 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Eclipse OMR Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. | 7.4 |
| 2019-09-12 | CVE-2019-11773 | Uncontrolled Search Path Element vulnerability in Eclipse OMR Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | 7.8 |
| 2019-09-11 | CVE-2019-11777 | Improper Handling of Exceptional Conditions vulnerability in Eclipse Paho Java Client 1.2.0 In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. | 7.5 |
| 2019-08-09 | CVE-2019-11776 | Cross-site Scripting vulnerability in Eclipse Business Intelligence and Reporting Tools In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. | 6.1 |
| 2019-07-30 | CVE-2019-11775 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in multiple products All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. | 7.4 |
| 2019-07-17 | CVE-2019-11772 | Out-of-bounds Write vulnerability in Eclipse Openj9 In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. | 9.8 |
| 2019-07-17 | CVE-2019-11771 | Permissions, Privileges, and Access Controls vulnerability in Eclipse Openj9 AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | 7.8 |
| 2019-06-14 | CVE-2019-11770 | Incorrect Resource Transfer Between Spheres vulnerability in Eclipse Buildship In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. | 8.1 |