6 results (0.006 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-41038

https://notcve.org/view.php?id=CVE-2021-41038

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage(). En versiones del componente @theia/plugin-ext de Eclipse Theia anteriores a 1.18.0, el contenido de la Webview puede ser secuestrado por medio de la función postMessage() • https://bugs.eclipse.org/bugs/show_bug.cgi?id=575924 https://github.com/eclipse-theia/theia/pull/10125 • CWE-940: Improper Verification of Source of a Communication Channel •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-34435

https://notcve.org/view.php?id=CVE-2021-34435

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.. En Eclipse Theia versiones 0.3.9 a 1.8.1, la extensión "mini-browser" permite al usuario previsualizar archivos HTML en un iframe dentro del IDE. Pero con la forma en que está hecha es posible para un archivo HTML previsualizado desencadenar un RCE. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018 • CWE-346: Origin Validation Error CWE-942: Permissive Cross-domain Policy with Untrusted Domains •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-28162

https://notcve.org/view.php?id=CVE-2021-28162

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. En Eclipse Theia versiones hasta 0.16.0 incluyendo, en los mensajes de notificación no se presenta un escape HTML, por lo que se puede ejecutar el código Javascript • https://github.com/eclipse-theia/theia/issues/7283 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE-830: Inclusion of Web Functionality from an Untrusted Source •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-28161

https://notcve.org/view.php?id=CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected. En Eclipse Theia versiones hasta 1.8.0 incluyendo, en la consola de depuración no se presenta un escape HTML, por lo que puede ser inyectado código Javascript arbitrario • https://github.com/eclipse-theia/theia/issues/8794 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 2

CVE-2020-27224

https://notcve.org/view.php?id=CVE-2020-27224

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code. Eclipse Theia versiones hasta 1.2.0 incluyendo, la Markdown Preview (@theia/preview), puede ser explotado para ejecutar código arbitrario • https://github.com/eclipse-theia/theia/issues/7954 https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •