CVE-2012-2395

cobbler: command injection flaw in the power management XML-RPC API

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed

Vendors

Michael Dehaan Redhat

Products

Cobbler Network Satellite

CVE-2012-2673

gc: malloc() and calloc() overflows

Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed

Vendors

Boehm-demers-weiser Redhat

Products

Garbage Collector Enterprise Linux Network Proxy and 1 more

CVE-2012-3143

JDK: unspecified vulnerability (JMX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-5089.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2012-3159

JDK: unspecified vulnerability (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1533.

CVSS 2.0 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2012-3213

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Scripting)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

CVSS 2.0 · 10.0 Critical EPSS 9.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2012-3216

OpenJDK: java.io.FilePermission information leak (Libraries, 6631398)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

CVSS 2.0 · 2.6 Low EPSS 2.9% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-3342

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 10.0 Critical EPSS 8.3% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Network Satellite and 3 more

CVE-2012-3525

jabberd: Prone to unsolicited XMPP Dialback attacks

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

CVSS 2.0 · 5.8 Medium EPSS 1.7% KEV · Not listed

Vendors

Jabber2 Jabberd2 Redhat

Products

Jabberd2 Jabberd2 Network Proxy and 1 more

CVE-2012-4820

JDK: java.lang.reflect.Method invoke() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."

CVSS 2.0 · 9.3 Critical EPSS 5.1% KEV · Not listed

Vendors

Ibm Redhat Tivoli Storage Productivity Center

Products

Java Lotus Domino Lotus Notes and 15 more

CVE-2012-4822

JDK: java.lang.class code execution

Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via vectors related to "insecure use [of] multiple methods in the java.lang.class class."

CVSS 2.0 · 9.3 Critical EPSS 6.9% KEV · Not listed

Vendors

Ibm Redhat Tivoli Storage Productivity Center

Products

Java Lotus Domino Lotus Notes and 15 more

CVE-2012-4823

JDK: java.lang.ClassLoder defineClass() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allows remote attackers to execute arbitrary code via vectors related to "insecure use of the java.lang.ClassLoder defineClass() method."

CVSS 2.0 · 9.3 Critical EPSS 6.9% KEV · Not listed

Vendors

Ibm Redhat Tivoli Storage Productivity Center

Products

Java Lotus Domino Lotus Notes and 15 more

CVE-2012-5068

OpenJDK: RhinoScriptEngine security bypass (Scripting, 7143535)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5069

OpenJDK: Executors state handling issues (Concurrency, 7189103)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Concurrency.

CVSS 2.0 · 5.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5071

OpenJDK: DescriptorSupport insufficient package access checks (JMX, 7192975)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity, related to JMX.

CVSS 2.0 · 6.4 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5072

OpenJDK: AccessController.doPrivilegedWithCombiner() information disclosure (Security, 7172522)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5073

OpenJDK: LogManager security bypass (Libraries, 7169884)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5079.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5075

OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5079

OpenJDK: ServiceLoader reject not subtype classes without instantiating (Libraries, 7195919)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5073.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5081

OpenJDK: JSSE denial of service (JSSE, 7186286)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.

CVSS 2.0 · 5.0 Medium EPSS 45.1% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jdk Jre Enterprise Linux and 4 more

CVE-2012-5083

JDK: unspecified vulnerability (2D)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, 1.4.2_38 and earlier, and JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Javafx Jdk Jre and 4 more