Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 823

Export CSV
CVE-2012-5072

OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5073

OpenJDK: LogManager security bypass (Libraries, 7169884)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5079.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5074

OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7169887)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality and integrity, related to JAX-WS.

CVSS 2.0 · 6.4 Medium EPSS 3.1% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2012-5075

OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5077

OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security.

CVSS 2.0 · 2.6 Low EPSS 3.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2012-5079

OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5073.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5081

OpenJDK: JSSE denial of service (JSSE, 7186286)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.

CVSS 2.0 · 5.0 Medium EPSS 45.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5083

JDK: unspecified vulnerability (2D)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, 1.4.2_38 and earlier, and JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 4 more
CVE-2012-5084

OpenJDK: DefaultFormatter insufficient data validation (Swing, 7195194)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.

CVSS 2.0 · 7.6 High EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5085

OpenJDK: disable Gopher support by default (Gopher, 7189567)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a vulnerability and this issue should not be included in CVE.

CVSS 2.0 · 0.0 Low EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2012-5086

OpenJDK: XMLDecoder sandbox restriction bypass (Beans, 7195917)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2012-5087

OpenJDK: PropertyElementHandler insufficient access checks (Beans, 7195549)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2012-5088

OpenJDK: MethodHandle insufficient access control checks (Libraries, 7196190)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 78.7% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2012-5089

OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-3143.

CVSS 2.0 · 7.6 High EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2012-5373

java: Murmur hash function collisions (oCERT-2012-001)

Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Oracle
Products
Jdk Jre Openjdk
CVE-2013-0351

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 7.5 High EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0401

OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.

CVSS 2.0 · 10.0 Critical EPSS 10.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 2 more
CVE-2013-0402

JDK: unspecified JavaFX buffer overflow leading to JVM compromise (CanSecWest 2013, JavaFX)

Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 9.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Javafx Jdk Jre and 1 more
CVE-2013-0409

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JMX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0419

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 7.6 High EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more