RSS   Podatności dla 'Theia'   RSS

2021-11-10
 
CVE-2021-41038

NVD-CWE-Other
 
 
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

 
2021-03-12
 
CVE-2021-28162

CWE-829
 
 
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

 
 
CVE-2021-28161

CWE-79
 
 
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

 
2021-02-24
 
CVE-2020-27224

CWE-79
 
 
In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.

 
2020-03-10
 
CVE-2019-17636

CWE-345
 
 
In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

 

 >>> Vendor: Eclipse 30 Produkty
Jetty
Eclipse ide
BIRT
Mojarra
Tinydtls
Mosquitto
KURA
IDE
Vert.x
Openj9
Rdf4j
Wakaama
Hawkbit
OMR
Paho java client
Vorto
Jersey
CHE
Memory analyzer
Theia
Web tools platform
HONO
Californium
Cyclone data distribution service
KETI
Paho mqtt c\/c\+\+ client
Lemminx
Cyclonedds
LYO
Equinox p2

Copyright 2024, cxsecurity.com

 

Back to Top