CVE-2019-10753

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.

• CWE-669

• https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377Third Party Advisory

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10748Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 a…9.8
• CVE-2019-10749sequelize before version 3.35.1 allows attackers to perform …9.8
• CVE-2019-1075A spoofing vulnerability exists in ASP.NET Core that could l…
• CVE-2019-10750deeply is vulnerable to Prototype Pollution in versions befo…9.8
• CVE-2019-10751All versions of the HTTPie package prior to version 1.0.3 ar…
• CVE-2019-10752Sequelize, all versions prior to version 4.44.3 and 5.15.1, …9.8
• CVE-2019-10754Multiple classes used within Apereo CAS before release 6.1.0…8.1
• CVE-2019-10755The SAML identifier generated within SAML2Utils.java was fou…4.9
• CVE-2019-10756It is possible to inject JavaScript within node-red-dashboar…5.4
• CVE-2019-10757knex.js versions before 0.19.5 are vulnerable to SQL Injecti…9.8
• CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Exe…9.9
• CVE-2019-10759safer-eval before 1.3.4 are vulnerable to Arbitrary Code Exe…9.9