Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 757

Export CSV
CVE-2007-2435

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.

CVSS 2.0 · 10.0 Critical EPSS 5.0% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Java Enterprise System and 2 more
CVE-2008-3108

Security Vulnerability with JRE fonts processing may allow Elevation of Privileges (6450319)

Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2006-2937

openssl ASN.1 DoS

OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.

CVSS 2.0 · 7.8 High EPSS 11.0% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Network Satellite
CVE-2008-3107

JDK untrusted applet/application privilege escalation (6661918)

Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVSS 2.0 · 10.0 Critical EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2007-2052

python off-by-one locale.strxfrm() (possible memory disclosure)

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

CVSS 2.0 · 5.0 Medium EPSS 14.1% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Network Satellite
CVE-2008-3106

security flaw

Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.

CVSS 2.0 · 4.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2009-3884

OpenJDK zoneinfo file existence information leak (6824265)

The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2008-3104

Java RE allows Same Origin Policy to be Bypassed (6687932)

Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.

CVSS 2.0 · 6.8 Medium EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2009-3883

OpenJDK information leaks in mutable variables (6657026,6657138)

Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657138.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 3 more
CVE-2009-3882

OpenJDK information leaks in mutable variables (6657026,6657138)

Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 3 more
CVE-2008-3103

OpenJDK JMX allows illegal operations with local monitoring (6332953)

Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.1% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2007-1860

mod_jk sends decoded URL to tomcat

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

CVSS 2.0 · 5.0 Medium EPSS 13.2% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jk Web Server Connector Network Satellite Rhel Application Server and 1 more
CVE-2009-3881

OpenJDK resurrected classloaders can still have children (6636650)

Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.

CVSS 2.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-3880

OpenJDK UI logging information leakage(6664512)

The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2008-2938

tomcat Unicode directory traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CVSS 2.0 · 4.3 Medium EPSS 99.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Enterprise Application Platform and 3 more
CVE-2009-3879

OpenJDK GraphicsConfiguration information leak(6822057)

Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the getConfigurations function, aka Bug Id 6822057.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2009-3877

OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVSS 2.0 · 5.0 Medium EPSS 4.9% KEV · Not listed
Vendors
Linux Microsoft Redhat and 1 more
Products
Linux Kernel Windows Enterprise Linux and 7 more
CVE-2008-2370

tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

CVSS 2.0 · 5.0 Medium EPSS 52.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 4 more
CVE-2007-1858

tomcat anonymous cipher issue

The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.

CVSS 2.0 · 2.6 Low EPSS 18.3% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Network Satellite Rhel Application Server
CVE-2009-3876

OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Linux Microsoft Redhat and 1 more
Products
Linux Kernel Windows Enterprise Linux and 7 more