CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2719 – JDK DoS with crafted .jnlp file
https://notcve.org/view.php?id=CVE-2009-2719
10 Aug 2009 — The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP). La implementación de Java Web Start en Sun Java SE v6 anteriores a Update 15 permite a los atacantes dependientes del contexto provocar una denegación de servicio (excepción de... • http://java.sun.com/javase/6/webnotes/6u15.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2720 – JDK DoS with Swing Synthcontext implementation
https://notcve.org/view.php?id=CVE-2009-2720
10 Aug 2009 — Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException in the Jemmy library) via unknown vectors. Vulnerabilidad no especificada en el método javax.swing.plaf.synth.SynthContext.isSubregion en la implementación de Swing en Sun Java SE v6 anteriores a Update 15 permite a los atacantes dependientes del contexto provocar una denegac... • http://java.sun.com/javase/6/webnotes/6u15.html •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2009-2721 – JDK Multiple unspecified vulnerabilities in Provider class
https://notcve.org/view.php?id=CVE-2009-2721
10 Aug 2009 — Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003. Múltiples vulnerabilidades no especificadas en la clase "Provider" en Sun Java SE v5.0 anteriores a Update 20 tienen un impacto y vectores de ataque desconocidos, también conocido como BugId 6406003. • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html •
CVSS: 10.0EPSS: 4%CPEs: 1EXPL: 0CVE-2009-2722 – JDK Multiple unspecified vulnerabilities in Provider class (incorrect fix)
https://notcve.org/view.php?id=CVE-2009-2722
10 Aug 2009 — Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594. NOTE: this issue exists because of an incorrect fix for BugId 6406003. Múltiples vulnerabilidades sin especificar en la clase Provider en Sun Java SE v5.0 anterior a la actualización 20, tiene un impacto y vectores de ataque desconocidos, también conocido como BugId 6429594. NOTA: esta vulnerabilidad existe por una incorrecta corrección del BugId 6406003. • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html •
CVSS: 10.0EPSS: 4%CPEs: 1EXPL: 0CVE-2009-2723 – JDK unspecified deserialization in Provider class
https://notcve.org/view.php?id=CVE-2009-2723
10 Aug 2009 — Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262. Vulnerabilidad sin especificar en la deserialización en la clase Provider en Sun Java SE v5.0 anterior a la actualización 20, tiene un impacto y vectores de ataque desconocidos, también conocido como BufId 6444262 • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2724 – JDK race condition vulnerability reflection checks
https://notcve.org/view.php?id=CVE-2009-2724
10 Aug 2009 — Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks." Condición de carrera en el paquete java.lang en Sun Java SE v5.0 anterior a la actualización 20 tiene un impacto y vectores de ataque desconocidos, relacionados con "Condición de carrera 3Y en comprobaciones de reflexión". • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 10.0EPSS: 7%CPEs: 3EXPL: 0CVE-2009-2689 – OpenJDK JDK13Services grants unnecessary privileges (6777448)
https://notcve.org/view.php?id=CVE-2009-2689
10 Aug 2009 — JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application. JDK13Services.getProviders en Sun Java SE v5.0 anteriores a Update 20 y v6 anteriores a Update 15, y en OpenJDK, proporciona privilegios completos a instancias de tipos de objeto no especificadas, permitiendo a atacante... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 4%CPEs: 2EXPL: 0CVE-2009-2690 – OpenJDK private variable information disclosure (6777487)
https://notcve.org/view.php?id=CVE-2009-2690
10 Aug 2009 — The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application. The codificador en Sun Java SE v6 anteriores a Update 15, y OpenJDK, permite acceso de lectura a variables privadas con nombres no especificados, permitiendo a atacantes dependientes del contexto obtener información sensible mediante (1) un applet o (2) una aplicació... • http://java.sun.com/javase/6/webnotes/6u15.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2009-2475 – OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)
https://notcve.org/view.php?id=CVE-2009-2475
10 Aug 2009 — Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslI... • http://java.sun.com/j2se/1.5.0/ReleaseNotes.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2009-2476 – OpenJDK OpenType checks can be bypassed (6736293)
https://notcve.org/view.php?id=CVE-2009-2476
10 Aug 2009 — The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object. La implementación de Java Management Extensions (JMX) en Sun Java SE v6 anteriores a Update 15, y en OpenJDK, no refuerza adecuadamente las validaciones OpenType, permitiendo a los atacantes dependientes de... • http://java.sun.com/javase/6/webnotes/6u15.html • CWE-264: Permissions, Privileges, and Access Controls •