Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 823

Export CSV
CVE-2013-0446

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0448

JDK: unspecified vulnerability fixed in 7u13 (Libraries)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Rhel Extras
CVE-2013-0449

JDK: unspecified vulnerability fixed in 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Rhel Extras
CVE-2013-0450

OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0809

OpenJDK: Specially crafted sample model integer overflow (2D, 8007014)

Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.

CVSS 2.0 · 10.0 Critical EPSS 10.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1473

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1475

OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1476

OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1478

OpenJDK: image parser insufficient raster parameter checks (2D, 8001972)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1479

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JavaFX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 3 more
CVE-2013-1480

OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.7% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1481

JDK: unspecified vulnerability fixed in 6u39 (Sound)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1484

OpenJDK: MethodHandleProxies insufficient privilege checks (Libraries, 8004937)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1485

OpenJDK: MethodHandles insufficient privilege checks (Libraries, 8006439)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1486

OpenJDK: MBeanServer insufficient privilege restrictions (JMX, 8006446)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 2.0 · 10.0 Critical EPSS 6.9% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1487

JDK: unspecified vulnerability fixed in 6u41 and 7u15 (Deployment)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-1488

OpenJDK: JDBC driver manager improper toString calls (CanSecWest 2013, Libraries, 8009814)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 87.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-1489

7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Google Microsoft Mozilla and 3 more
Products
Chrome Internet Explorer Firefox and 4 more
CVE-2013-1490

JDK: complete Java security sandbox bypass (Issue 51)

Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Oracle
Products
Jdk Jre
CVE-2013-1491

JDK: unspecified sanbox bypass (CanSecWest 2013, 2D)

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 16.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Network Satellite and 1 more