Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 28

Export CSV
CVE-2012-1723

OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 3.1 · 9.8 Critical EPSS 93.6% KEV · Listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 7 more
CVE-2017-3544

OpenJDK: newline injection in the SMTP client (Networking, 8171533)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.0 · 3.7 Low EPSS 2.0% KEV · Not listed
Vendors
Debian Google Oracle and 1 more
Products
Debian Linux Android Jdk and 14 more
CVE-2017-3539

OpenJDK: MD5 allowed for jar verification (Security, 8171121)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

CVSS 3.0 · 3.1 Low EPSS 2.0% KEV · Not listed
Vendors
Debian Oracle Redhat
Products
Debian Linux Jdk Jre and 12 more
CVE-2017-3512

OpenJDK: window framing issues on MacOSX (AWT, 8165626)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS 3.0 · 8.3 High EPSS 2.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Icedtea
CVE-2017-3533

OpenJDK: newline injection in the FTP client (Networking, 8170222)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.0 · 3.7 Low EPSS 3.0% KEV · Not listed
Vendors
Debian Oracle Redhat
Products
Debian Linux Jdk Jre and 13 more
CVE-2013-6493

icedtea-web: insecure temporary file use flaw in LiveConnect implementation

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Icedtea-web
CVE-2015-5234

icedtea-web: unexpected permanent authorization of unsigned applets

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Opensuse Enterprise Linux and 5 more
CVE-2015-5235

icedtea-web: applet origin spoofing

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Opensuse Enterprise Linux and 5 more
CVE-2016-0636

OpenJDK: missing type safety checks for MethodHandle calls across class loaders, incorrect CVE-2013-5838 fix (Hotspot, 8151666)

Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.

CVSS 3.0 · 8.1 High EPSS 5.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 6 more
CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 11 more
CVE-2011-2513

icedtea-web: home directory path disclosure to untrusted applications

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Icedtea-web Icedtea6
CVE-2011-2514

icedtea-web: Java Web Start security warning dialog manipulation

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Icedtea-web Icedtea6
CVE-2013-1926

icedtea-web: class loader sharing for applets with same codebase paths

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.

CVSS 2.0 · 5.8 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Opensuse Redhat
Products
Ubuntu Linux Opensuse Enterprise Linux and 1 more
CVE-2010-4351

IcedTea jnlp security manager bypass

The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Icedtea Openjdk
CVE-2011-0706

IcedTea multiple signers privilege escalation

The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."

CVSS 2.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Redhat Sun
Products
Icedtea-web Jdk
CVE-2011-0025

IcedTea jarfile signature verification bypass

IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Icedtea
CVE-2011-3377

IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Opensuse Redhat
Products
Ubuntu Linux Opensuse Enterprise Linux and 1 more
CVE-2012-1717

OpenJDK: insecure temporary file permissions (JRE, 7143606)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Oracle Redhat and 2 more
Products
Linux Kernel Jdk Jre and 20 more
CVE-2010-3860

IcedTea System property information leak via public static

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Icedtea