{"vulnerability": "CVE-2020-2722", "sightings": [{"uuid": "97cfc93f-292b-4f3e-8389-b58625257e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27223", "type": "seen", "source": "https://t.me/cibsecurity/24264", "content": "\u203c CVE-2020-27223 \u203c\n\nIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of \u00c3\u00a2\u00e2\u201a\u00ac\u00c5\u201cquality\u00c3\u00a2\u00e2\u201a\u00ac? (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-27T00:39:46.000000Z"}, {"uuid": "56119df6-c7bb-40c7-8188-bc28418a5e8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27224", "type": "seen", "source": "https://t.me/cibsecurity/24089", "content": "\u203c CVE-2020-27224 \u203c\n\nIn Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-24T20:36:59.000000Z"}, {"uuid": "8f742a95-05d2-4291-8fde-87995e84ba37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27225", "type": "seen", "source": "https://t.me/cibsecurity/24644", "content": "\u203c CVE-2020-27225 \u203c\n\nIn versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-09T22:51:50.000000Z"}, {"uuid": "dc4b91e8-b330-4465-a76d-d24a35b3057d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27222", "type": "seen", "source": "https://t.me/cibsecurity/23024", "content": "\u203c CVE-2020-27222 \u203c\n\nIn Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because it sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshakes failure with TLS parameter mismatch. The server must be restarted to recover this. This allow clients to force a DoS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-03T18:49:28.000000Z"}, {"uuid": "bf043f0c-7496-41d5-a436-0f59bc14a823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27220", "type": "seen", "source": "https://t.me/cibsecurity/22193", "content": "\u203c CVE-2020-27220 \u203c\n\nThe Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-15T02:50:06.000000Z"}, {"uuid": "1f2d2c2a-001c-4c32-b773-3a4ccbcb660a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-27223", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/495", "content": "CVE-2020-27223 Eclipse Jetty \u62d2\u7d55\u670d\u52d9\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-27223_Eclipse_Jetty_%E6%8B%92%E7%B5%95%E6%9C%8D%E5%8B%99%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-22T02:40:44.000000Z"}]}