CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 0CVE-2018-2641 – OpenJDK: GTK library loading use-after-free (AWT, 8185325)
https://notcve.org/view.php?id=CVE-2018-2641
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may sig... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0CVE-2018-2663 – OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)
https://notcve.org/view.php?id=CVE-2018-2663
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnera... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 0CVE-2018-2677 – OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289)
https://notcve.org/view.php?id=CVE-2018-2677
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability t... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0CVE-2018-2678 – OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142)
https://notcve.org/view.php?id=CVE-2018-2678
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerabilit... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2018-2582 – OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962)
https://notcve.org/view.php?id=CVE-2018-2582
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion ... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html •
CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0CVE-2018-2588 – OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449)
https://notcve.org/view.php?id=CVE-2018-2588
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JR... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 5.8EPSS: 0%CPEs: 35EXPL: 0CVE-2018-2599 – OpenJDK: DnsClient missing source port randomization (JNDI, 8182125)
https://notcve.org/view.php?id=CVE-2018-2599
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, J... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-330: Use of Insufficiently Random Values •
CVSS: 4.5EPSS: 0%CPEs: 34EXPL: 0CVE-2018-2602 – OpenJDK: loading of classes from untrusted locations (I18n, 8182601)
https://notcve.org/view.php?id=CVE-2018-2602
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability ca... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-426: Untrusted Search Path •
CVSS: 5.3EPSS: 0%CPEs: 35EXPL: 0CVE-2018-2603 – OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387)
https://notcve.org/view.php?id=CVE-2018-2603
18 Jan 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (part... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-15100 – foreman: Stored XSS in fact name or value
https://notcve.org/view.php?id=CVE-2017-15100
27 Nov 2017 — An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page. Un atacante que envíe hechos que contienen HTML al servidor Foreman puede provocar Cross-Site Scripting (XSS) persistente en ciertas páginas: (1) La página Facts, al hacer clic en el ... • http://projects.theforeman.org/issues/21519 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •