Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 127

Export CSV
CVE-2008-3104

Java RE allows Same Origin Policy to be Bypassed (6687932)

Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.

CVSS 2.0 · 6.8 Medium EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3107

JDK untrusted applet/application privilege escalation (6661918)

Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVSS 2.0 · 10.0 Critical EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3108

Security Vulnerability with JRE fonts processing may allow Elevation of Privileges (6450319)

Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3111

Java Web Start Buffer overflow vulnerabilities (6557220)

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

CVSS 2.0 · 10.0 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3112

Java Web Start, arbitrary file creation (6703909)

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.

CVSS 2.0 · 10.0 Critical EPSS 25.7% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3113

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3114

Java Web Start, untrusted application may determine Cache Location (6704074)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.

CVSS 2.0 · 5.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5339

JavaWebStart allows unauthorized network connections

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via unknown vectors, aka CR 6727079.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5340

Java WebStart privilege escalation

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.

CVSS 2.0 · 10.0 Critical EPSS 3.8% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5341

Java Web Start exposes username and the pathname of the JWS cache

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors, aka CR 6727071.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5342

Java Web Start BasicService displays local files in the browser

Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be displayed in the browser of the user of the untrusted application via unknown vectors, aka 6767668.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5343

Java WebStart allows hidden code privilege escalation

Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.

CVSS 2.0 · 9.0 Critical EPSS 5.1% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5344

Java WebStart unprivileged local file and network access

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets to read arbitrary files and make unauthorized network connections via unknown vectors related to applet classloading, aka 6716217.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-5345

JRE allows unauthorized file access and connections to localhost

Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read arbitrary files and make unauthorized connections to localhost via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5346

JRE allows unauthorized memory read access via a crafted ZIP file

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file.

CVSS 2.0 · 7.1 High EPSS 2.8% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5348

OpenJDK Denial-Of-Service in kerberos authentication (6588160)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.

CVSS 2.0 · 7.1 High EPSS 4.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5350

OpenJDK allows to list files within the user home directory (6484091)

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and applets to list the contents of the operating user's directory via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5351

OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-5353

OpenJDK calendar object deserialization allows privilege escalation (6734167)

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

CVSS 2.0 · 10.0 Critical EPSS 86.1% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2009-1098

OpenJDK GIF processing buffer overflow vulnerability (6804998)

Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 3 more