Eclipse aeriOS vulnerabilities
4 known vulnerabilities in Eclipse aeriOS from Eclipse Foundation. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Eclipse aeriOS: Exposure of Sensitive Information to an Unauthorized Actor
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed t
- 8.3 High severity
Eclipse aeriOS: Improper Certificate Validation
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment v
- 8.8 High severity
Eclipse aeriOS: Improper Limitation of a Pathname to a Restricted Directory
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate
- 9.0 Critical severity
Eclipse aeriOS: Improper Certificate Validation
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_security parameter hard-coded to true, with no option to override it through the Hel