Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2008-4503

Adobe Flash Player clickjacking

The Settings Manager in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements, as demonstrated by hijacking the camera or microphone, and related to "clickjacking."

CVSS 2.0 · 6.8 Medium EPSS 5.3% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2008-4401

flash-plugin: upload/download user interaction

ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.

CVSS 2.0 · 10.0 Critical EPSS 9.0% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2007-4768

: pcre before 7.3 incorrect unicode in char class optimization

Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed
Vendors
Pcre Redhat
Products
Pcre Rhel Extras
CVE-2008-3872

security flaw

Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers to bypass the allowScriptAccess parameter setting via a crafted SWF file with unspecified "Filter evasion" manipulations.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2008-3873

flash: clipboard hijack attack

The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard with a URL that is difficult to delete and does not require user interaction to populate the clipboard, as exploited in the wild in August 2008.

CVSS 2.0 · 4.3 Medium EPSS 17.0% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2007-4381

java: Vulnerability in the font parsing code

Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.

CVSS 2.0 · 9.3 Critical EPSS 5.4% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2009-1105

OpenJDK: Possibility of trusted applet run in older, vulnerable version of JRE (6706490)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE version, which can be used to exploit vulnerabilities in that older version, aka CR 6706490.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Java
CVE-2008-3114

Java Web Start, untrusted application may determine Cache Location (6704074)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.

CVSS 2.0 · 5.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3113

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2007-4324

Flash movie can determine whether a TCP port is open

ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.

CVSS 2.0 · 5.0 Medium EPSS 8.0% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2008-3112

Java Web Start, arbitrary file creation (6703909)

Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.

CVSS 2.0 · 10.0 Critical EPSS 25.7% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2008-3111

Java Web Start Buffer overflow vulnerabilities (6557220)

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

CVSS 2.0 · 10.0 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2007-3922

Vulnerability in the Java Runtime Environment May Allow an Untrusted Applet to Circumvent Network Access Restrictions

Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet's outbound connections by connecting to certain localhost services running on the machine that loaded the applet.

CVSS 2.0 · 6.8 Medium EPSS 2.9% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Rhel Extras Jdk and 2 more
CVE-2009-1104

OpenJDK: Intended access restrictions bypass via LiveConnect (6724331)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.

CVSS 2.0 · 5.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Java
CVE-2009-1106

OpenJDK: Improper parsing of crossdomain.xml files (intended access restriction bypass) (6798948)

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

CVSS 2.0 · 6.4 Medium EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2009-1855

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via a PDF file containing a malformed U3D model file with a crafted extension block.

CVSS 2.0 · 9.3 Critical EPSS 12.4% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2008-3110

security flaw

Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.

CVSS 2.0 · 4.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre
CVE-2008-3109

Security Vulnerabilities in the Java Runtime Environment Scripting Language Support (6529568, 6529579)

Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre
CVE-2007-3698

Java Secure Socket Extension Does Not Correctly Process SSL/TLS Handshake Requests Resulting in a Denial of Service (DoS) Condition

The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier, JDK and JRE 5.0 Updates 7 through 11, and SDK and JRE 1.4.2_11 through 1.4.2_14, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.

CVSS 2.0 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2008-3108

Security Vulnerability with JRE fonts processing may allow Elevation of Privileges (6450319)

Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more