Eclipse IDE vulnerabilities

3 CVEs affecting Eclipse IDE, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4218, published 2023-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-4647, published 2011-01-13. Medium severity, CVSS 4.3. EPSS: 5.7% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or…
CVE-2008-7271, published 2011-01-13. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or…
CVE-2023-4218, published 2023-11-09. Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project…