CVSS: 10.0EPSS: 0%CPEs: 114EXPL: 0CVE-2004-2764
https://notcve.org/view.php?id=CVE-2004-2764
Sun SDK and Java Runtime Environment (JRE) 1.4.2 through 1.4.2_04, 1.4.1 through 1.4.1_07, and 1.4.0 through 1.4.0_04 allows untrusted applets and unprivileged servlets to gain privileges and read data from other applets via unspecified vectors related to classes in the XSLT processor, aka "XML sniffing." Sun SDK y Java Runtime Environment (JRE) desde la v1.4.2 hasta la v1.4.2_04, desde la v1.4.1 hasta la v1.4.1_07, y la v1.4.0 hasta la v1.4.0_04 permite a applets sin confianza y servlets sin privilegios conseguir privilegios y leer datos de otros applets a través de vectores sin especificar relacionados con las clases en el procesador XSLT, también conocido como "esnifado XML". • http://archive.cert.uni-stuttgart.de/uniras/2004/08/msg00007.html http://groups.google.com/group/comp.security.unix/tree/browse_frm/month/2004-10/fe63f1daa9689d50?rnum=161&_done=%2Fgroup%2Fcomp.security.unix%2Fbrowse_frm%2Fmonth%2F2004-10%3Ffwc%3D1%26#doc_29036353582c690d http://secunia.com/advisories/12206 http://securitytracker.com/id?1011661 http://www.osvdb.org/8288 http://www.securityfocus.com/archive/1/371208 http://www.securityfocus.com/bid/10844 https://exchange.xforce.ibmcloud.c • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 21EXPL: 0CVE-2009-1006
https://notcve.org/view.php?id=CVE-2009-1006
Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Vulnerabilidad no especificada en el componente JRockit de BEA Product Suite R27.6.2 y anteriores, con SDK/JRE v1.4.2, JRE/JDK v5 y JRE/JDK v6; permite a atacantes remotos comprometer la confidencialidad, integridad y disponibilidad a través de vectores desconocidos. • http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html http://www.securityfocus.com/bid/34461 http://www.securitytracker.com/id?1022059 http://www.us-cert.gov/cas/techalerts/TA09-105A.html •
CVSS: 5.0EPSS: 15%CPEs: 153EXPL: 0CVE-2009-1093 – OpenJDK remote LDAP Denial-Of-Service (6717680)
https://notcve.org/view.php?id=CVE-2009-1093
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang). LdapCtx en el servicio LDAP en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v5.0 actualización 17 y anteriores; 6 actualización 12 y anteriores; SDK y JRE v1.3.1_24 y anteriores; y v1.4.2_19 y anteriores no cierran la conexión cuando la inicialización falla, lo que permite a los atacantes remotos causar una denegación de servicio (cuelgue del servicio LDAP ). • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34489 http://secunia.co • CWE-16: Configuration •
CVSS: 10.0EPSS: 2%CPEs: 153EXPL: 0CVE-2009-1094 – OpenJDK LDAP client remote code execution (6737315)
https://notcve.org/view.php?id=CVE-2009-1094
Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data. Vulnerabilidad no especificada en la implementación LDAP de Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v5.0 Update 17 y anteriores, v6 Update 12 y anteriores, SDK y JRE v1.3.1_24 y anteriores, y v1.4.2_19 y anteriores; permite a servidores LDAP remotos ejecutar código de su elección a través de vectores desconocidos relacionados con los datos en serie. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34489 http://secunia.co •
CVSS: 9.3EPSS: 29%CPEs: 153EXPL: 0CVE-2009-1098 – OpenJDK GIF processing buffer overflow vulnerability (6804998)
https://notcve.org/view.php?id=CVE-2009-1098
Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998. Desbordamiento del búfer en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v5.0 Update 17 y anteriores; v6 Update 12 y anteriores; v1.4.2_19 y anteriores; y 1.3.1_24 y anteriores, permite a atacantes remotos acceder a ficheros o ejecutar código de su elección a través de una imagen GIF manipulada. También se conoce como CR 6804998. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34489 http://secunia.co • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •