WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor eclipse✕
Overview 9 matches · 1 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
9matches 1exploited11.1% 0CISA KEV0.0% 3public PoC33.3% 2EPSS ≥ 0.522.2%
Protected by Waratek 9 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 9 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 11.1% Working exploit published 2 22.2% Proof of concept only 3 33.3% Forecast only 0 0.0% No public exploit 3 33.3%
split by peak 2 / quarter
Protected by Waratek: 9 Medium: 9 blocked by ARMR today: 9 No public exploit: 3Proof of concept only: 3Working exploit published: 2Exploited: 1
Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 212 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 Q3 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Q4 210 Q1 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q2 220 Q3 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q4 220 Q1 231 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 Q2 230 Q3 230 Q4 231 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 251 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1
Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-4949 Medium 2025-05-21 Protected by Waratek Proof of concept only In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVE-2023-4218 Medium 2023-11-09 Protected by Waratek Proof of concept only In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
CVE-2023-24815 Medium 2023-02-09 Protected by Waratek Proof of concept only Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.
CVE-2021-41042 Medium 2022-07-07 Protected by Waratek No public exploit In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
CVE-2022-0673 Medium 2022-02-18 Protected by Waratek No public exploit A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2019-17091 Medium 2019-10-02 Protected by Waratek No public exploit faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.