In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0611 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 7     CVEs: CVE-2024-41091, CVE-2024-53122, CVE-2023-4208, CVE-2024-57882, CVE-2023-4207, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1259 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 7     CVEs: CVE-2024-41091, CVE-2024-53122, CVE-2024-57882, CVE-2023-4206, CVE-2023-4208, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0395 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.2. It addresses 14 CVEs:
    CVE-2025-38120, CVE-2025-38124, CVE-2024-42281, CVE-2024-27397, CVE-2023-4128, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all     sorts of XXE attacks. The user just needs to open any evil project or update an open project with a     vulnerable file (for example for review a foreign repository or patch). (CVE-2023-4218)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all
    sorts of XXE attacks. The user just needs to open any evil project or update an open project with a
    vulnerable file (for example for review a foreign repository or patch). (CVE-2023-4218)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1304-1 advisory.

    eclipse received the following security fix:

    - CVE-2023-4218: Fixed a bug where parsing files with xml content laeds to XXE attacks. (bsc#1216992)

    maven-sunfire was updated from version 2.22.0 to 2.22.2:

    - Changes in version 2.22.2:

      * Bugs fixed:

        - Fixed JUnit Runner that writes to System.out corrupts Surefires STDOUT when using JUnits     Vintage           Engine

    - Changes in version 2.22.1:

      * Bugs fixed:

        - Fixed Surefire unable to run testng suites in parallel
        - Fixed Git wrongly considering PNG files as changed when there is no change
        - Fixed the surefire XSD published on maven site lacking of some rerun element
        - Fixed XML Report elements rerunError, rerunFailure, flakyFailure, flakyError
        - Fixed overriding platform version through project/plugin dependencies
        - Fixed mixed up characters in standard output
        - Logs in Parallel Tests are mixed up when `forkMode=never` or `forkCount=0`
        - MIME type for javascript is now officially application/javascript

      * Improvements:

        - Elapsed time in XML Report should satisfy pattern in XSD.
        - Fix old test resources TEST-*.xml in favor of continuing with SUREFIRE-1550
        - Nil element failureMessage in failsafe-summary.xml should have self closed tag
        - Removed obsolete module `surefire-setup-integration-tests`
        - Support Java 11
        - Surefire should support parameterized reportsDirectory

      * Dependency upgrades:

        - Upgraded maven-plugins parent to version 32
        - Upgraded maven-plugins parent to version 33

    tycho received the following bug fixes:

    - Fixed build against maven-surefire 2.22.1 and newer
    - Fixed build against newer plexus-compiler
    - Fixed issues with plexus-archiver 4.4.0 and newer
    - Require explicitely artifacts that will not be required automatically any more

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
356747	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_0611)	Nessus	Rocky Linux Local Security Checks	Local	high
355657	Rocky Linux 9.2 [CIQ] Security Update: bpftool-debuginfo Multiple Vulnerabilities (ciqsa-2026_1259)	Nessus	Rocky Linux Local Security Checks	Local	high
354201	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_0395)	Nessus	Rocky Linux Local Security Checks	Local	high
262274	Linux Distros Unpatched Vulnerability : CVE-2023-4218	Nessus	Misc.	Local	medium
416053	SCA: security update for org.eclipse.jdt:org.eclipse.jdt.ui, org.eclipse.platform:org.eclipse.core.runtime, org.eclipse.platform:org.eclipse.jface, org.eclipse.platform:org.eclipse.platform, org.eclipse.platform:org.eclipse.ui.forms, org.eclipse.platform:org.eclipse.ui.ide, org.eclipse.platform:org.eclipse.ui.workbench, org.eclipse.platform:org.eclipse.urischeme (GHSA-j24h-xcpc-9jw8)	Tenable Cloud Security	SCA Checks	Local	medium
416053	SCA: security update for org.eclipse.jdt:org.eclipse.jdt.ui, org.eclipse.platform:org.eclipse.core.runtime, org.eclipse.platform:org.eclipse.jface, org.eclipse.platform:org.eclipse.platform, org.eclipse.platform:org.eclipse.ui.forms, org.eclipse.platform:org.eclipse.ui.ide, org.eclipse.platform:org.eclipse.ui.workbench, org.eclipse.platform:org.eclipse.urischeme (GHSA-j24h-xcpc-9jw8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
193388	SUSE SLED15: eclipse-contributor-tools / eclipse-emf-core / etc (SUSE-SU-2024:1304-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2023-4218

medium

Tenable Plugins

high

high

high

medium

medium

medium

medium