Advisories · Technology
Spring Tools for Eclipse.
Every CVE that names Spring Tools for Eclipse among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.3 Low
HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
- Spring Tools for Eclipse
- Spring Tools for VSCode / Cursor / Theia
- Information disclosure
- CVSS 4.2 Medium
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
- Spring Tools for Eclipse
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
- Spring Tools for Eclipse
- Information disclosure
- CVSS 8.3 High
Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
- Spring Tools for Eclipse
- Weak cryptography or TLS
- CVSS 8.0 High
Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
- Spring Tools for Eclipse
- CWE-1327
- CVSS 8.0 High
live information startup mode is vulnerable for remote code execution
- Spring Tools for Eclipse
- Spring Tools for VSCode / Cursor / Theia
- Authentication bypass