Vulnerabilities > Eclipse > High

DATE CVE VULNERABILITY TITLE RISK
2019-04-22 CVE-2019-10248 Incorrect Resource Transfer Between Spheres vulnerability in Eclipse Vorto
Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS.
network
high complexity
eclipse CWE-669
8.1
2019-04-19 CVE-2019-10245 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes.
network
low complexity
eclipse redhat CWE-119
7.5
2019-04-09 CVE-2019-10244 XXE vulnerability in Eclipse Kura
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.
network
low complexity
eclipse CWE-611
7.5
2019-04-03 CVE-2019-10240 Cleartext Transmission of Sensitive Information vulnerability in Eclipse Hawkbit
Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS.
network
high complexity
eclipse CWE-319
8.1
2019-03-27 CVE-2018-12545 Allocation of Resources Without Limits or Throttling vulnerability in multiple products
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames.
network
low complexity
eclipse fedoraproject CWE-770
7.5
2019-03-27 CVE-2017-7655 NULL Pointer Dereference vulnerability in multiple products
In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library.
network
low complexity
eclipse debian CWE-476
7.5
2019-03-27 CVE-2018-12551 Improper Authentication vulnerability in Eclipse Mosquitto
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid.
network
high complexity
eclipse CWE-287
8.1
2019-03-27 CVE-2018-12550 Unspecified vulnerability in Eclipse Mosquitto
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy.
network
high complexity
eclipse
8.1
2019-02-22 CVE-2019-9004 Memory Leak vulnerability in Eclipse Wakaama 1.0
In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak.
network
low complexity
eclipse CWE-401
7.5
2018-12-19 CVE-2018-20227 Path Traversal vulnerability in Eclipse Rdf4J
RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
network
low complexity
eclipse CWE-22
7.5