The Eclipse Foundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-0100 In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the repoHigh 8.8 · Mar 15, 2023
• CVE-2022-2576 In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without usHigh 7.5 · Jul 29, 2022
• CVE-2021-41037 In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation.Critical 10 · Jul 8, 2022
• CVE-2022-2191 In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in caseHigh 7.5 · Jul 7, 2022
• CVE-2022-2048 In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning High 7.5 · Jul 7, 2022
• CVE-2021-41039 In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leHigh 7.5 · Dec 1, 2021
• CVE-2021-41036 In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.Critical 9.8 · Nov 2, 2021
• CVE-2021-41035 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.Critical 9.8 · Oct 25, 2021
• CVE-2021-41034 The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint.High 8.1 · Sep 29, 2021
• CVE-2021-41033 In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using pHigh 8.1 · Sep 13, 2021
• CVE-2021-34436 In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension.Critical 9.8 · Sep 2, 2021
• CVE-2021-34435 In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.High 8.8 · Sep 1, 2021
• CVE-2021-34433 In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifHigh 7.5 · Aug 20, 2021
• CVE-2021-34432 In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.High 7.5 · Jul 27, 2021
• CVE-2021-34430 Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decHigh 7.5 · Jul 7, 2021
• CVE-2021-34427 In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) Critical 9.8 · Jun 25, 2021
• CVE-2021-28165 In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.High 7.5 · Apr 1, 2021
• CVE-2020-27225 In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unHigh 7.8 · Mar 9, 2021
• CVE-2020-27224 In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.Critical 9.6 · Feb 24, 2021
• CVE-2020-27222 In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to aHigh 7.5 · Feb 3, 2021
• CVE-2020-27221 In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting Critical 9.8 · Jan 21, 2021
• CVE-2020-27220 The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when iHigh 8.8 · Jan 14, 2021
• CVE-2020-27217 In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices.High 7.5 · Nov 13, 2020
• CVE-2020-27216 In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's tHigh 7 · Oct 23, 2020
• CVE-2019-17640 In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0Critical 9.8 · Oct 15, 2020