CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2020-14782 – OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)
https://notcve.org/view.php?id=CVE-2020-14782
21 Oct 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: ... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html • CWE-295: Improper Certificate Validation •
CVSS: 5.8EPSS: 0%CPEs: 32EXPL: 0CVE-2020-14792 – OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114)
https://notcve.org/view.php?id=CVE-2020-14792
21 Oct 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, in... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 3.1EPSS: 0%CPEs: 23EXPL: 0CVE-2020-14796 – OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680)
https://notcve.org/view.php?id=CVE-2020-14796
21 Oct 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read acc... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html •
CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2020-14797 – OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)
https://notcve.org/view.php?id=CVE-2020-14797
21 Oct 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: ... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html • CWE-20: Improper Input Validation •
CVSS: 3.1EPSS: 0%CPEs: 23EXPL: 0CVE-2020-14798 – Gentoo Linux Security Advisory 202409-26
https://notcve.org/view.php?id=CVE-2020-14798
21 Oct 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, ... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14573 – OpenJDK: Incomplete interface type checks in Graal compiler (Hotspot, 8236867)
https://notcve.org/view.php?id=CVE-2020-14573
15 Jul 2020 — Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html •
CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14562 – OpenJDK: Excessive memory usage in ImageIO TIFF plugin (ImageIO, 8233239)
https://notcve.org/view.php?id=CVE-2020-14562
15 Jul 2020 — Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Jav... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 75EXPL: 0CVE-2020-2654 – OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)
https://notcve.org/view.php?id=CVE-2020-2654
15 Jan 2020 — Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in th... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2020-2659 – OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)
https://notcve.org/view.php?id=CVE-2020-2659
15 Jan 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vul... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 2%CPEs: 68EXPL: 0CVE-2020-2604 – OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)
https://notcve.org/view.php?id=CVE-2020-2604
15 Jan 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typi... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html • CWE-471: Modification of Assumed-Immutable Data (MAID) CWE-502: Deserialization of Untrusted Data •