Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 396

Export CSV
CVE-2013-1486

OpenJDK: MBeanServer insufficient privilege restrictions (JMX, 8006446)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1487

JDK: unspecified vulnerability fixed in 6u41 and 7u15 (Deployment)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1493

OpenJDK: CMM malformed raster memory corruption (2D, 8007675)

The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.

CVSS 2.0 · 10.0 Critical EPSS 86.2% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1500

OpenJDK: Insecure shared memory permissions (2D, 8001034)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 5 more
CVE-2013-1518

OpenJDK: JAXP missing security restrictions (JAXP, 6657673)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1537

OpenJDK: remote code loading enabled by default (RMI, 8001040)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.

CVSS 2.0 · 10.0 Critical EPSS 9.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1540

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2433.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1557

OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1558

OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

CVSS 2.0 · 10.0 Critical EPSS 7.3% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1563

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.

CVSS 2.0 · 7.6 High EPSS 5.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 4 more
CVE-2013-1569

ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004994)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.

CVSS 2.0 · 10.0 Critical EPSS 8.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1571

OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.

CVSS 2.0 · 4.3 Medium EPSS 66.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 6 more
CVE-2013-2383

ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004986)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2384, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "handling of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.

CVSS 2.0 · 10.0 Critical EPSS 8.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-2384

ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004987)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2383, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font layout" in the International Components for Unicode (ICU) Layout Engine before 51.2.

CVSS 2.0 · 10.0 Critical EPSS 8.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-2394

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (2D)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-2432 and CVE-2013-1491.

CVSS 2.0 · 7.6 High EPSS 5.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 4 more
CVE-2013-2407

OpenJDK: Integrate Apache Santuario, rework class loader (Libraries, 6741606, 8008744)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "XML security and the class loader."

CVSS 2.0 · 6.4 Medium EPSS 5.2% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 5 more
CVE-2013-2412

OpenJDK: JConsole SSL support (Serviceability, 8003703)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient indication of an SSL connection failure by JConsole, related to RMI connection dialog box.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 5 more
CVE-2013-2417

OpenJDK: Network InetAddress serialization information disclosure (Networking, 8000724)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an information leak involving InetAddress serialization. CVE has not investigated the apparent discrepancy between vendor reports regarding the impact of this issue.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-2418

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-2419

ICU: Layout Engine font processing errors (JDK 2D, 8001031)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.

CVSS 2.0 · 5.0 Medium EPSS 22.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more