Cross-Site Request Forgery

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks wi…CVE-2018-12540The Eclipse Foundation · 2.0% likely

   CWE-352

2. For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no…CVE-2019-17633The Eclipse Foundation · 0.8% likely

   CWE-352

3. Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it comp…CVE-2020-35217Eclipse · 0.6% likely

   CWE-352

4. A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the Same…CVE-2020-14368Eclipse · 0.5% likely

   CWE-352

5. In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attack…CVE-2026-60009Eclipse Foundation · CVSS 8.8 · 0.4% likely

   CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.