Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 757

Export CSV
CVE-2009-3875

OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Linux Microsoft Redhat and 1 more
Products
Linux Kernel Windows Enterprise Linux and 7 more
CVE-2008-2369

Satellite: information disclosure via manzier.pxt RPC script

manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.

CVSS 3.1 · 9.1 Critical EPSS 3.3% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2009-3874

OpenJDK ImageI/O JPEG heap overflow (6874643)

Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.

CVSS 2.0 · 9.3 Critical EPSS 9.5% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2009-3873

OpenJDK JPEG Image Writer quantization problem (6862968)

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2008-2086

Java Web Start File Inclusion via System Properties Override

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home, (2) java.ext.dirs, or (3) user.home System Properties, aka "Java Web Start File Inclusion" and CR 6694892.

CVSS 2.0 · 9.3 Critical EPSS 7.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2007-1358

tomcat accept-language xss flaw

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CVSS 2.0 · 2.6 Low EPSS 19.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 4 more
CVE-2009-3872

JRE JPEG JFIF Decoder issue (6862969)

Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2009-3871

OpenJDK JRE AWT setBytePixels heap overflow (6872358)

Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2008-1947

Tomcat host manager xss - name field

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.

CVSS 2.0 · 4.3 Medium EPSS 9.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Network Satellite and 2 more
CVE-2009-3869

OpenJDK JRE AWT setDifflCM stack overflow (6872357)

Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.

CVSS 2.0 · 9.3 Critical EPSS 65.4% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Enterprise Linux Network Satellite and 7 more
CVE-2009-3868

java-1.6.0-sun: Privilege escalation via crafted image file due improper color profiles parsing (6862970)

Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2008-1232

tomcat: Cross-Site-Scripting enabled by sendError call

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.

CVSS 2.0 · 4.3 Medium EPSS 75.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 4 more
CVE-2007-1355

tomcat XSS in samples

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 58.2% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Network Satellite
CVE-2009-3867

java-1.6.0-sun: Stack-based buffer overflow via a long file: URL argument (6854303)

Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

CVSS 2.0 · 9.3 Critical EPSS 73.2% KEV · Not listed
Vendors
Microsoft Redhat Sun
Products
Windows Network Satellite Rhel Extras and 6 more
CVE-2009-3866

java-1.6.0-sun: Privilege escalation in the Java Web Start Installer (6872824)

The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.

CVSS 2.0 · 9.3 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2008-1196

Buffer overflow security vulnerabilities in Java Web Start

Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code via a crafted JNLP file.

CVSS 2.0 · 6.8 Medium EPSS 7.3% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 2 more
CVE-2009-3865

java-1.6.0-sun: ACE in JRE Deployment Toolkit (6869752)

The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

CVSS 2.0 · 9.3 Critical EPSS 9.4% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2009-3728

OpenJDK ICC_Profile file existence detection information leak (6631533)

Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 2 more
CVE-2008-1195

Java-API calls in untrusted Javascript allow network privilege escalation

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed
Vendors
Canonical Redhat Sun
Products
Ubuntu Linux Network Satellite Rhel Extras and 3 more
CVE-2007-1349

mod_perl PerlRun denial of service

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

CVSS 2.0 · 5.0 Medium EPSS 10.4% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Mod Perl Ubuntu Linux Certificate System and 9 more