CVE-2019-10249

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494 CWE-829 CWE-116

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Xtext	>= unspecified, < 2.18.0

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996Issue Tracking, Vendor Advisory
https://github.com/eclipse/xtext-xtend/issues/759Exploit, Issue Tracking, Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996Issue Tracking, Vendor Advisory
https://github.com/eclipse/xtext-xtend/issues/759Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10256.5A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulne CVE-2019-102505.9UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.CVE-2019-102515.9The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Offi CVE-2019-102536.5A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upl CVE-2019-102546.1In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.CVE-2019-102556.1An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.CVE-2019-102569.8An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.CVE-2019-102577.5Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-CVE-2019-10267.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code CVE-2019-102606.1Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).CVE-2019-102614.8CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functi CVE-2019-102629.8A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, an