# cve.now: THE Eclipse Foundation

The newest entries naming THE Eclipse Foundation as an affected vendor (up to 200), of 101 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2023-0100](https://cve.now/CVE-2023-0100.md): In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HT (no CVSS)
- [CVE-2022-2712](https://cve.now/CVE-2022-2712.md): In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path st (CVSS 6.5)
- [CVE-2022-3676](https://cve.now/CVE-2022-3676.md): In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. (CVSS 6.5)
- [CVE-2022-2838](https://cve.now/CVE-2022-2838.md): In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities all (no CVSS)
- [CVE-2022-2576](https://cve.now/CVE-2022-2576.md): In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter (no CVSS)
- [CVE-2021-41037](https://cve.now/CVE-2021-41037.md): In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installati (CVSS 10.0)
- [CVE-2021-41042](https://cve.now/CVE-2021-41042.md): In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working (no CVSS)
- [CVE-2022-2191](https://cve.now/CVE-2022-2191.md): In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured By (CVSS 7.5)
- [CVE-2022-2047](https://cve.now/CVE-2022-2047.md): In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment o (CVSS 2.7)
- [CVE-2022-2048](https://cve.now/CVE-2022-2048.md): In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up no (CVSS 7.5)
- [CVE-2021-41041](https://cve.now/CVE-2021-41041.md): In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is (no CVSS)
- [CVE-2021-41039](https://cve.now/CVE-2021-41039.md): In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause exc (no CVSS)
- [CVE-2021-41038](https://cve.now/CVE-2021-41038.md): In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage(). (no CVSS)
- [CVE-2021-41036](https://cve.now/CVE-2021-41036.md): In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem\_len size in readpacket. (no CVSS)
- [CVE-2021-41035](https://cve.now/CVE-2021-41035.md): In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface meth (no CVSS)
- [CVE-2021-41034](https://cve.now/CVE-2021-41034.md): The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. (no CVSS)
- [CVE-2021-41033](https://cve.now/CVE-2021-41033.md): In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-midd (no CVSS)
- [CVE-2021-34436](https://cve.now/CVE-2021-34436.md): In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-ext (no CVSS)
- [CVE-2021-34435](https://cve.now/CVE-2021-34435.md): In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. (no CVSS)
- [CVE-2021-34434](https://cve.now/CVE-2021-34434.md): In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a (no CVSS)
- [CVE-2021-34433](https://cve.now/CVE-2021-34433.md): In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally su (no CVSS)
- [CVE-2021-34432](https://cve.now/CVE-2021-34432.md): In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0. (no CVSS)
- [CVE-2021-34431](https://cve.now/CVE-2021-34431.md): In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the (no CVSS)
- [CVE-2021-34429](https://cve.now/CVE-2021-34429.md): For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con (CVSS 5.3)
- [CVE-2021-34430](https://cve.now/CVE-2021-34430.md): Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the mas (no CVSS)
- [CVE-2021-34427](https://cve.now/CVE-2021-34427.md): In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curre (no CVSS)
- [CVE-2021-34428](https://cve.now/CVE-2021-34428.md): For Eclipse Jetty versions \<= 9.4.40, \<= 10.0.2, \<= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, th (CVSS 2.9)
- [CVE-2021-28169](https://cve.now/CVE-2021-28169.md): For Eclipse Jetty versions \<= 9.4.40, \<= 10.0.2, \<= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to a (CVSS 5.3)
- [CVE-2021-28170](https://cve.now/CVE-2021-28170.md): In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be (no CVSS)
- [CVE-2021-28168](https://cve.now/CVE-2021-28168.md): Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. (CVSS 6.2)
- [CVE-2021-28167](https://cve.now/CVE-2021-28167.md): In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain (no CVSS)
- [CVE-2021-28166](https://cve.now/CVE-2021-28166.md): In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to th (CVSS 6.5)
- [CVE-2021-28165](https://cve.now/CVE-2021-28165.md): In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large inva (CVSS 7.5)
- [CVE-2021-28164](https://cve.now/CVE-2021-28164.md): In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segm (CVSS 5.3)
- [CVE-2021-28163](https://cve.now/CVE-2021-28163.md): In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, (CVSS 2.7)
- [CVE-2021-28162](https://cve.now/CVE-2021-28162.md): In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. (no CVSS)
- [CVE-2021-28161](https://cve.now/CVE-2021-28161.md): In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be inj (no CVSS)
- [CVE-2020-27225](https://cve.now/CVE-2020-27225.md): In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web se (no CVSS)
- [CVE-2020-27223](https://cve.now/CVE-2020-27223.md): In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept (CVSS 5.2)
- [CVE-2020-27224](https://cve.now/CVE-2020-27224.md): In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code. (no CVSS)
- [CVE-2020-27222](https://cve.now/CVE-2020-27222.md): In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS ser (no CVSS)
- [CVE-2020-27221](https://cve.now/CVE-2020-27221.md): In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI nat (no CVSS)
- [CVE-2020-27220](https://cve.now/CVE-2020-27220.md): The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & con (no CVSS)
- [CVE-2020-27219](https://cve.now/CVE-2020-27219.md): In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe (no CVSS)
- [CVE-2020-27218](https://cve.now/CVE-2020-27218.md): In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request bo (no CVSS)
- [CVE-2020-27217](https://cve.now/CVE-2020-27217.md): In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. (no CVSS)
- [CVE-2020-27216](https://cve.now/CVE-2020-27216.md): In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sys (no CVSS)
- [CVE-2019-17640](https://cve.now/CVE-2019-17640.md): In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, (no CVSS)
- [CVE-2019-17639](https://cve.now/CVE-2019-17639.md): In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the (no CVSS)
- [CVE-2019-17637](https://cve.now/CVE-2019-17637.md): In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be expl (no CVSS)
- [CVE-2019-17638](https://cve.now/CVE-2019-17638.md): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce (no CVSS)
- [CVE-2019-17636](https://cve.now/CVE-2019-17636.md): In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/min (no CVSS)
- [CVE-2019-17635](https://cve.now/CVE-2019-17635.md): Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is re (no CVSS)
- [CVE-2019-17634](https://cve.now/CVE-2019-17634.md): Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report fr (no CVSS)
- [CVE-2019-17633](https://cve.now/CVE-2019-17633.md): For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of (no CVSS)
- [CVE-2019-17632](https://cve.now/CVE-2019-17632.md): In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conte (no CVSS)
- [CVE-2019-17631](https://cve.now/CVE-2019-17631.md): From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without a (no CVSS)
- [CVE-2019-11779](https://cve.now/CVE-2019-11779.md): In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of appro (no CVSS)
- [CVE-2019-11778](https://cve.now/CVE-2019-11778.md): If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay inte (no CVSS)
- [CVE-2019-11774](https://cve.now/CVE-2019-11774.md): Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop (no CVSS)
- [CVE-2019-11773](https://cve.now/CVE-2019-11773.md): Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. (no CVSS)
- [CVE-2019-11777](https://cve.now/CVE-2019-11777.md): In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the res (no CVSS)
- [CVE-2019-11776](https://cve.now/CVE-2019-11776.md): In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. (no CVSS)
- [CVE-2019-11775](https://cve.now/CVE-2019-11775.md): All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the lo (no CVSS)
- [CVE-2019-11772](https://cve.now/CVE-2019-11772.md): In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte\[\], int) method does not verify that the provided byte array is non-null (no CVSS)
- [CVE-2019-11771](https://cve.now/CVE-2019-11771.md): AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. (no CVSS)
- [CVE-2019-11770](https://cve.now/CVE-2019-11770.md): In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTP (no CVSS)
- [CVE-2019-10249](https://cve.now/CVE-2019-10249.md): All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been c (no CVSS)
- [CVE-2019-10248](https://cve.now/CVE-2019-10248.md): Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. (no CVSS)
- [CVE-2019-10247](https://cve.now/CVE-2019-10247.md): In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version (no CVSS)
- [CVE-2019-10246](https://cve.now/CVE-2019-10246.md): In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Res (no CVSS)
- [CVE-2019-10241](https://cve.now/CVE-2019-10241.md): In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote cl (no CVSS)
- [CVE-2019-10245](https://cve.now/CVE-2019-10245.md): In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode ar (no CVSS)
- [CVE-2019-10244](https://cve.now/CVE-2019-10244.md): In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position (no CVSS)
- [CVE-2019-10243](https://cve.now/CVE-2019-10243.md): In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. (no CVSS)
- [CVE-2019-10242](https://cve.now/CVE-2019-10242.md): In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path travers (no CVSS)
- [CVE-2019-10240](https://cve.now/CVE-2019-10240.md): Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. (no CVSS)
- [CVE-2018-12545](https://cve.now/CVE-2018-12545.md): In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SET (no CVSS)
- [CVE-2017-7655](https://cve.now/CVE-2017-7655.md): In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to cra (no CVSS)
- [CVE-2018-12551](https://cve.now/CVE-2018-12551.md): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the p (no CVSS)
- [CVE-2018-12550](https://cve.now/CVE-2018-12550.md): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comme (no CVSS)
- [CVE-2018-12546](https://cve.now/CVE-2018-12546.md): In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that top (no CVSS)
- [CVE-2018-12549](https://cve.now/CVE-2018-12549.md): In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when ac (no CVSS)
- [CVE-2018-12547](https://cve.now/CVE-2018-12547.md): In Eclipse OpenJ9, prior to the 0.12.0 release, the jio\_snprintf() and jio\_vsnprintf() native methods ignored the length parameter. (no CVSS)
- [CVE-2018-12548](https://cve.now/CVE-2018-12548.md): In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which (no CVSS)
- [CVE-2018-12543](https://cve.now/CVE-2018-12543.md): In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is n (no CVSS)
- [CVE-2018-12544](https://cve.now/CVE-2018-12544.md): In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense (no CVSS)
- [CVE-2018-12542](https://cve.now/CVE-2018-12542.md): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a rest (no CVSS)
- [CVE-2018-12541](https://cve.now/CVE-2018-12541.md): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the h (no CVSS)
- [CVE-2018-12539](https://cve.now/CVE-2018-12539.md): In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM (no CVSS)
- [CVE-2018-12537](https://cve.now/CVE-2018-12537.md): In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and lin (no CVSS)
- [CVE-2018-12540](https://cve.now/CVE-2018-12540.md): In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form p (no CVSS)
- [CVE-2018-12536](https://cve.now/CVE-2018-12536.md): In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that do (no CVSS)
- [CVE-2017-7658](https://cve.now/CVE-2017-7658.md): In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when pr (no CVSS)
- [CVE-2017-7657](https://cve.now/CVE-2017-7657.md): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled (no CVSS)
- [CVE-2017-7656](https://cve.now/CVE-2017-7656.md): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled (no CVSS)
- [CVE-2018-12538](https://cve.now/CVE-2018-12538.md): In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSes (no CVSS)
- [CVE-2017-7654](https://cve.now/CVE-2017-7654.md): In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. (no CVSS)
- [CVE-2017-7653](https://cve.now/CVE-2017-7653.md): The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. (no CVSS)
- [CVE-2017-7652](https://cve.now/CVE-2017-7652.md): In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers (no CVSS)
- [CVE-2017-7651](https://cve.now/CVE-2017-7651.md): In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/the-eclipse-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.