Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2013-1478

OpenJDK: image parser insufficient raster parameter checks (2D, 8001972)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1479

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JavaFX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 3 more
CVE-2013-1480

OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.7% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1481

JDK: unspecified vulnerability fixed in 6u39 (Sound)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1484

OpenJDK: MethodHandleProxies insufficient privilege checks (Libraries, 8004937)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1485

OpenJDK: MethodHandles insufficient privilege checks (Libraries, 8006439)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1486

OpenJDK: MBeanServer insufficient privilege restrictions (JMX, 8006446)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1487

JDK: unspecified vulnerability fixed in 6u41 and 7u15 (Deployment)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1488

OpenJDK: JDBC driver manager improper toString calls (CanSecWest 2013, Libraries, 8009814)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 87.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1489

7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Google Microsoft Mozilla and 3 more
Products
Chrome Internet Explorer Firefox and 4 more
CVE-2013-1491

JDK: unspecified sanbox bypass (CanSecWest 2013, 2D)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 16.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Network Satellite and 1 more
CVE-2013-1493

OpenJDK: CMM malformed raster memory corruption (2D, 8007675)

The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.

CVSS 2.0 · 10.0 Critical EPSS 86.2% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1500

OpenJDK: Insecure shared memory permissions (2D, 8001034)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 5 more
CVE-2013-1518

OpenJDK: JAXP missing security restrictions (JAXP, 6657673)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1537

OpenJDK: remote code loading enabled by default (RMI, 8001040)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.

CVSS 2.0 · 10.0 Critical EPSS 9.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1540

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2433.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1557

OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1558

OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

CVSS 2.0 · 10.0 Critical EPSS 7.3% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1561

JDK: multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to JavaFX.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Javafx Jdk Jre and 1 more
CVE-2013-1563

JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.

CVSS 2.0 · 7.6 High EPSS 5.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 4 more