CVSS: 7.5EPSS: 70%CPEs: 3EXPL: 0CVE-2009-1099 – OpenJDK: Type1 font processing buffer overflow vulnerability
https://notcve.org/view.php?id=CVE-2009-1099
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow. Un error de firma de enteros en Java SE Development Kit (JDK) y Java Runtime Environment (JRE) versiones 5.0 Update 17 y anteriores, y versiones 6 Update 12 y anteriores, permite a los atacantes remotos acceder a archivos o ejecutar código arbitrario por medio de descripciones de glifos diseñados en una fuente Type1, lo que omite una comparación firmada y desencadena un desbordamiento de búfer. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=777 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236 • CWE-189: Numeric Errors •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1107 – OpenJDK: Signed applet remote misuse possibility (6782871)
https://notcve.org/view.php?id=CVE-2009-1107
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a signed applet via unknown vectors that misrepresent the security warning dialog, related to a "Swing JLabel HTML parsing vulnerability," aka CR 6782871. El plugin de Java de Java SE Development Kit (JDK) y Java Runtime Environment (JRE) v6 Update 12 y anteriores, y v5.0 Update 17 y anteriores, permite a atacantes remotos engañar a los usuarios para que confíen en un applet firmado a través de vectores desconocidos que tergiversan los diálogos de los avisos de seguridad . Está relacionado con una "Vulnerabilidad de análisis sintáctico de Swing JLabel HTML (Swing JLabel HTML parsing vulnerability)", también se conoce como CR 6782871. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html http://marc.info/?l=bugtraq&m=124344236532162&w=2 http://secunia.com/advisories/34495 http://secunia.com/advisories/34496 http://secunia.com/advisories/35156 http://secunia •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2009-1077
https://notcve.org/view.php?id=CVE-2009-1077
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password. La implementación de Change My Password en el intefase de administración en Sun Java System Identity Manager (IdM) v7.0 hasta v8.0 no refuerza el valor de la propiedad RequiresChallenge, lo que permite a usuarios remotos autenticados cambiar la contraseña a otros usuarios, como se demostró cambiando la contraseña al administrador. • http://blogs.sun.com/security/entry/sun_alert_253267_sun_java http://secunia.com/advisories/34380 http://securitytracker.com/id?1021881 http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 http://sunsolve.sun.com/search/document.do? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2009-1084
https://notcve.org/view.php?id=CVE-2009-1084
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object. Sun Java System Identity Manager (IdM) v7.0 a la v8.0, no restringe adecuadamente el acceso al objeto System Configuration, lo que permite a administradores autenticados remotamente y posiblemente a atacantes remotos, provocar un impacto desconocido mediante la modificación de este objeto. • http://blogs.sun.com/security/entry/sun_alert_253267_sun_java http://secunia.com/advisories/34380 http://securitytracker.com/id?1021881 http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 http://www.securityfocus.com/bid/34191 http://www.vupen.com/english/advisories/2009/0797 https://exchange.xforce.ibmcloud.com/vulnerabiliti • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2009-1080
https://notcve.org/view.php?id=CVE-2009-1080
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID 19033. Vulnerabilidad múltiple de ejecución de secuencias de comandos en sitios cruzados - XSS - en Sun Java System Identity Manager (IdM) 7.0 hasta 8.0 que permite a los atacantes remotos inyectar arbitrariamente una secuencia de comandos web o HTML a través de vectores no especificados, también conocidos como Bug ID 19033. • http://blogs.sun.com/security/entry/sun_alert_253267_sun_java http://secunia.com/advisories/34380 http://securitytracker.com/id?1021881 http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 http://www.securityfocus.com/bid/34191 http://www.vupen.com/english/advisories/2009/0797 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •