Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 757

Export CSV
CVE-2016-3427

OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1 · 9.8 Critical EPSS 92.3% KEV · Listed
Vendors
Apache Canonical Debian and 5 more
Products
Cassandra Ubuntu Linux Debian Linux and 39 more
CVE-2012-0507

OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

CVSS 3.1 · 9.8 Critical EPSS 98.2% KEV · Listed
Vendors
Debian Oracle Redhat and 2 more
Products
Debian Linux Jre Enterprise Linux and 7 more
CVE-2011-3544

OpenJDK: missing SecurityManager checks in scripting engine (Scripting, 7046823)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

CVSS 3.1 · 9.8 Critical EPSS 96.7% KEV · Listed
Vendors
Canonical Oracle Redhat and 1 more
Products
Ubuntu Linux Jdk Jre and 6 more
CVE-2013-2465

OpenJDK: Incorrect image channel verification (2D, 8012597)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

CVSS 3.1 · 9.8 Critical EPSS 98.8% KEV · Listed
Vendors
Oracle Redhat Sun and 1 more
Products
Jre Enterprise Linux Network Satellite and 7 more
CVE-2015-4902

JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1 · 5.3 Medium EPSS 13.6% KEV · Listed
Vendors
Opensuse Oracle Redhat and 1 more
Products
Leap Opensuse Jdk and 21 more
CVE-2010-0840

OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

CVSS 3.1 · 9.8 Critical EPSS 96.3% KEV · Listed
Vendors
Canonical Opensuse Oracle and 1 more
Products
Ubuntu Linux Opensuse Jre and 4 more
CVE-2015-2590

OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 22 more
CVE-2006-0898

perl-Crypt-CBC weaker encryption with some ciphers

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.

CVSS 2.0 · 2.6 Low EPSS 1.4% KEV · Not listed
Vendors
Lincoln D. Stein Redhat
Products
Crypt Cbc Network Satellite
CVE-2006-0254

tomcat examples XSS

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.

CVSS 2.0 · 4.3 Medium EPSS 32.2% KEV · Not listed
Vendors
Apache Redhat
Products
Geronimo Network Satellite Rhel Application Server
CVE-2005-4838

tomcat manager example DoS

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CVSS 2.0 · 4.3 Medium EPSS 7.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Network Satellite Rhel Application Server
CVE-2005-1080

jar: directory traversal vulnerability

Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file.

CVSS 2.0 · 5.0 Medium EPSS 5.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2004-0885

mod_ssl SSLCipherSuite bypass

The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.

CVSS 2.0 · 7.5 High EPSS 15.4% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Network Proxy and 3 more
CVE-2004-0687

openmotif21 stack overflows in libxpm

Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.

CVSS 2.0 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Openbsd Redhat Suse and 2 more
Products
Openbsd Enterprise Linux Network Satellite and 3 more
CVE-2005-3510

tomcat DoS

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

CVSS 2.0 · 5.0 Medium EPSS 6.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Network Satellite and 1 more
CVE-2006-3835

tomcat directory listing issue

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

CVSS 2.0 · 5.0 Medium EPSS 48.1% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Network Satellite and 1 more
CVE-2005-2969

openssl mitm downgrade attack

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Network Satellite and 1 more
CVE-2005-2096

zlib DoS

zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

CVSS 2.0 · 7.5 High EPSS 5.6% KEV · Not listed
Vendors
Redhat Zlib
Products
Enterprise Linux Network Satellite Zlib