CVE-2016-5423

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.

CVSS 3.0 · 8.3 High EPSS 6.0% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Enterprise Linux and 2 more

CVE-2013-2473

OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-3743

JDK: unspecified vulnerability fixed in 6u51 and 5u51 (AWT)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.

CVSS 2.0 · 9.3 Critical EPSS 6.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 4 more

CVE-2013-3829

OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029)

Unspecified vulnerability in the Java SE, Java SE Embedded component in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0 · 6.4 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-4041

JDK: unspecified sandbox bypass (JVM)

Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Ibm Redhat

Products

Java Network Satellite Rhel Extras

CVE-2013-4415

Spacewalk: PAGE_SIZE_LABEL_SELECTED cross-site scripting (XSS)

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software channels search; (2) end_year, (3) start_hour, (4) end_am_pm, (5) end_day, (6) end_hour, (7) end_minute, (8) end_month, (9) end_year, (10) optionScanDateSearch, (11) result_filter, (12) search_string, (13) show_as, (14) start_am_pm, (15) start_day, (16) start_hour, (17) start_minute, (18) start_month, (19) start_year, or (20) whereToSearch variable in an scap audit results search; (21) end_minute, (22) end_month, (23) end_year, (24) errata_type_bug, (25) errata_type_enhancement, (26) errata_type_security, (27) fineGrained, (28) list_1892635924_sortdir, (29) optionIssueDateSearch, (30) start_am_pm, (31) start_day, (32) start_hour, (33) start_minute, (34) start_month, (35) start_year, or (36) view_mode variable in an errata search; or (37) fineGrained variable in a systems search, related to PAGE_SIZE_LABEL_SELECTED.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat Suse

Products

Network Satellite Satellite Satellite 5 Managed Db and 3 more

CVE-2013-4480

Satellite: Interface to create the initial administrator user remains open after installation

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Redhat Suse

Products

Network Satellite Satellite Satellite With Embedded Oracle and 2 more

CVE-2013-5372

JDK: XML4J xml entity expansion excessive memory use (XML)

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Ibm Redhat

Products

Websphere Message Broker Network Satellite Rhel Extras

CVE-2013-5375

JDK: unspecified sandbox bypass (XML)

Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.

CVSS 2.0 · 6.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Ibm Redhat

Products

Java Network Satellite Rhel Extras

CVE-2012-1721

JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722.

CVSS 2.0 · 10.0 Critical EPSS 5.3% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Network Satellite and 1 more

CVE-2013-5772

OpenJDK: insufficient html escaping in jhat (jhat, 8011081)

Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat.

CVSS 2.0 · 2.6 Low EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-5774

OpenJDK: Inet6Address class IPv6 address processing errors (Libraries, 8015743)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-5776

JDK: unspecified vulnerability fixed in 7u45 (Deployment)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 4 more

CVE-2013-5778

OpenJDK: image conversion out of bounds read (2D, 8014102)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-5780

OpenJDK: key data leak via toString() methods (Libraries, 8011071)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

CVSS 2.0 · 4.3 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Jrockit and 6 more

CVE-2013-5782

OpenJDK: Incorrect awt_getPixelByte/awt_getPixelShort/awt_setPixelByte/awt_setPixelShort image raster checks (2D, 8014093)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.3% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Jrockit and 6 more

CVE-2013-5783

OpenJDK: JTable not properly performing certain access checks (Swing, 8013744)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Swing.

CVSS 2.0 · 6.4 Medium EPSS 3.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-5784

OpenJDK: insufficient InterfaceImplementor security checks (Scripting, 8017299)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to SCRIPTING.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 5 more

CVE-2013-5787

JDK: unspecified vulnerability fixed in 7u45 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5789, CVE-2013-5824, CVE-2013-5832, and CVE-2013-5852.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 4 more

CVE-2013-5789

JDK: unspecified vulnerability fixed in 7u45 (Deployment)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5787, CVE-2013-5824, CVE-2013-5832, and CVE-2013-5852.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 4 more