CVE-2019-10248

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494 CWE-829 CWE-669

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Vorto	>= unspecified, < 0.11

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622Third Party Advisory

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102498.1All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been c CVE-2019-10256.5A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulne CVE-2019-102505.9UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.CVE-2019-102515.9The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Offi CVE-2019-102536.5A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upl CVE-2019-102546.1In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.CVE-2019-102556.1An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.CVE-2019-102569.8An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.CVE-2019-102577.5Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-CVE-2019-10267.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code CVE-2019-102606.1Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).CVE-2019-102614.8CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functi