Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 827

Export CSV
CVE-2013-5888

JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, when running with GNOME, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Network Satellite and 2 more
CVE-2013-1479

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JavaFX)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Javafx Jdk Jre and 3 more
CVE-2013-1478

OpenJDK: image parser insufficient raster parameter checks (2D, 8001972)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1476

OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-1475

OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2013-1473

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0809

OpenJDK: Specially crafted sample model integer overflow (2D, 8007014)

Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.

CVSS 2.0 · 10.0 Critical EPSS 10.8% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0450

OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0449

JDK: unspecified vulnerability fixed in 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Rhel Extras
CVE-2013-0448

JDK: unspecified vulnerability fixed in 7u13 (Libraries)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Rhel Extras
CVE-2013-0446

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0445

OpenJDK: insufficient privilege checking issue (AWT, 8001057)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0444

OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2013-0443

OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0442

OpenJDK: insufficient privilege checking issue (AWT, 7192977)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0441

OpenJDK: missing serialization restriction (CORBA, 7201066)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."

CVSS 2.0 · 10.0 Critical EPSS 8.1% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0440

OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more
CVE-2013-0438

JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Network Satellite and 3 more
CVE-2013-0437

JDK: unspecified vulnerability fixed in 7u13 (2D)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Javafx Jdk Jre and 1 more
CVE-2013-0435

OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed
Vendors
Oracle Redhat Sun
Products
Jdk Jre Enterprise Linux and 4 more