Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2009-3875

OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Linux Microsoft Redhat and 1 more
Products
Linux Kernel Windows Enterprise Linux and 7 more
CVE-2008-5342

Java Web Start BasicService displays local files in the browser

Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be displayed in the browser of the user of the untrusted application via unknown vectors, aka 6767668.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2007-5400

RealPlayer: SWF Frame Handling Buffer Overflow

Heap-based buffer overflow in the Shockwave Flash (SWF) frame handling in RealNetworks RealPlayer 10.5 Build 6.0.12.1483 might allow remote attackers to execute arbitrary code via a crafted SWF file.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Real Realnetworks Redhat
Products
Realplayer Realplayer Rhel Extras
CVE-2009-3874

OpenJDK ImageI/O JPEG heap overflow (6874643)

Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.

CVSS 2.0 · 9.3 Critical EPSS 9.5% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2009-3873

OpenJDK JPEG Image Writer quantization problem (6862968)

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2008-5341

Java Web Start exposes username and the pathname of the JWS cache

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2009-3872

JRE JPEG JFIF Decoder issue (6862969)

Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2009-3871

OpenJDK JRE AWT setBytePixels heap overflow (6872358)

Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2008-5340

Java WebStart privilege escalation

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.

CVSS 2.0 · 10.0 Critical EPSS 3.8% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2007-5275

Flash plugin DNS rebinding

The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed
Vendors
Adobe Redhat
Products
Shockwave Player Rhel Extras
CVE-2009-3869

OpenJDK JRE AWT setDifflCM stack overflow (6872357)

Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

CVSS 2.0 · 9.3 Critical EPSS 65.4% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2009-3868

java-1.6.0-sun: Privilege escalation via crafted image file due improper color profiles parsing (6862970)

Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2008-5339

JavaWebStart allows unauthorized network connections

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via unknown vectors, aka CR 6727079.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2009-3867

java-1.6.0-sun: Stack-based buffer overflow via a long file: URL argument (6854303)

Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVSS 2.0 · 9.3 Critical EPSS 73.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2009-3866

java-1.6.0-sun: Privilege escalation in the Java Web Start Installer (6872824)

The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.

CVSS 2.0 · 9.3 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2008-4824

security flaw

Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."

CVSS 2.0 · 9.3 Critical EPSS 21.1% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2007-5274

Anti-DNS Pinning and Java Applets with Opera and Firefox

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273. NOTE: this is similar to CVE-2007-5232.

CVSS 2.0 · 2.6 Low EPSS 2.7% KEV · Not listed
Vendors
Mozilla Opera Redhat and 1 more
Products
Firefox Opera Browser Rhel Extras and 3 more
CVE-2009-3865

java-1.6.0-sun: ACE in JRE Deployment Toolkit (6869752)

The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

CVSS 2.0 · 9.3 Critical EPSS 9.4% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2009-3800

flash-plugin: multiple code execution flaws (APSB09-19) (CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798, CVE-2009-3799, CVE-2009-3800)

Multiple unspecified vulnerabilities in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allow attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 7.6% KEV · Not listed
Vendors
Adobe Redhat
Products
Adobe Air Flash Player Rhel Extras
CVE-2008-4823

Flash Player HTML injection flaw

Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.

CVSS 2.0 · 4.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras