CVSS: 10.0EPSS: 0%CPEs: 117EXPL: 0CVE-2011-3521 – Oracle Java IIOP Deserialization Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-3521
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE, 7, 6 Update 27 and earlier, and 5.0 Update 31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deserialization. Vulnerabilidad no especificada en el componente de Java Runtime Environment en Oracle Java SE JDK y JRE, v7, v6 Update 27 y anteriores, y v5.0 Update 31 y anteriores permite a aplicaciones Java Web Start remotas no confiables y applets Java no confiables para que afecten a la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con la deserialización. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Java handles IIOP deserialization. Due to insufficient type checking it is possible to trick java into allowing access to otherwise protected and private fields in built-in objects. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html http://marc.info/?l=bugtraq&m=132750579901589&w=2 http://marc.info/?l=bugtraq&m=133365109612558&w=2 http://marc.info/?l=bugtraq&m=134254866602253&w=2 http://marc.info/?l=bugtraq&m=134254957702612&w=2 http://rhn.redhat.com/errata/RHSA-2013-1455.html http://secunia.com/advisories/48308 http://secunia.com/advisories/48692 http://security.gentoo.org/glsa/glsa-201406-32.xml http://www.ibm •
CVSS: 7.5EPSS: 55%CPEs: 192EXPL: 1CVE-2011-3556 – Java RMI - Server Insecure Default Configuration Java Code Execution
https://notcve.org/view.php?id=CVE-2011-3556
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557. Vulnerabilidad no especificada en el componente Java Runtime Environment en Oracle Java SE JDK y JRE 7, 6 Update 27 y versiones anteriores, 5.0 Update 31 y versiones anteriores, 1.4.2_33 y versiones anteriores y JRockit R28.1.4 y versiones anteriores permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad, relacionada con RMI, una vulnerabilidad diferente a CVE-2011-3557. • https://www.exploit-db.com/exploits/17535 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html http://marc.info/?l=bugtraq&m=132750579901589&w=2 http://marc.info/?l=bugtraq&m=133365109612558&w=2 http://marc.info/?l=bugtraq&m=133728004526190&w=2 http://marc.info/?l=bugtraq&m=134254866602253&w=2 http://marc.info/? •
CVSS: 2.6EPSS: 0%CPEs: 185EXPL: 0CVE-2011-3552 – OpenJDK: excessive default UDP socket limit under SecurityManager (Networking, 7032417)
https://notcve.org/view.php?id=CVE-2011-3552
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote attackers to affect integrity via unknown vectors related to Networking. Vulnerabilidad no especificada en el componente de Java Runtime Environment en Oracle Java SE JDK y JRE v7, v6 Update 27 y anteriores, v5.0 Update 31 y anteriores, y v1.4.2_33 y anteriores permite a atacantes remotos afectar a la integridad a través de vectores desconocidos relacionados con el Networking. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html http://marc.info/?l=bugtraq&m=132750579901589&w=2 http://marc.info/?l=bugtraq&m=133365109612558&w=2 http://marc.info/?l=bugtraq&m=133728004526190&w=2 http://marc.info/?l=bugtraq&m=134254866602253&w=2 http://marc.info/? •
CVSS: 7.5EPSS: 5%CPEs: 27EXPL: 0CVE-2009-2674 – Java Web Start Buffer JPEG processing integer overflow (6823373)
https://notcve.org/view.php?id=CVE-2009-2674
Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen, which triggers a heap-based buffer overflow. Un desbordamiento de enteros en el archivo javaws.exe en Sun Java Web Start en Sun Java Runtime Environment (JRE) en JDK y JRE versión 6 anterior a Update 15, permite a los atacantes dependiendo del contexto ejecutar código arbitrario por medio de una imagen JPEG creada que no se maneja apropiadamente durante la visualización de una imagen de bienvenida, que desencadena un desbordamiento de búfer basado en la región heap de la memoria. • http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html http://marc.info/?l=bugtraq&m=125787273209737&w=2 http://secunia.com/advisories/36162 http://secunia.com/advisories/36176 http://secunia.com/advisories/36180 http://secunia.com/advisories/36248 • CWE-190: Integer Overflow or Wraparound CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 61EXPL: 0CVE-2009-2671 – OpenJDK Proxy mechanism information leaks (6801071)
https://notcve.org/view.php?id=CVE-2009-2671
The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors. El SOCKS proxy implementado en Java Runtime Environment (JRE) en JDK y JRE v6 anterior Update v15, y JDK y JRE v5.0 anterior Update v20, permite a atacantes remotos descubrir la cuenta de usuario que invoca un (1) applet o (2)aplicación Java Web Start no confiable a través de vectores no especificados. • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 http://java.sun.com/javase/6/webnotes/6u15.html http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html http://marc.info/?l=bugtraq&m=125787273209737&w=2 http://secunia.com/advisories •