CVSS: 4.3EPSS: 0%CPEs: 39EXPL: 0CVE-2019-2973 – OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)
https://notcve.org/view.php?id=CVE-2019-2973
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://access.redhat.com/errata/RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:3157 https&# • CWE-248: Uncaught Exception •
CVSS: 5.8EPSS: 0%CPEs: 40EXPL: 0CVE-2019-2975 – OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)
https://notcve.org/view.php?id=CVE-2019-2975
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://access.redhat.com/errata/RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:4113 https&# • CWE-248: Uncaught Exception •
CVSS: 6.8EPSS: 0%CPEs: 19EXPL: 0CVE-2019-2989 – OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)
https://notcve.org/view.php?id=CVE-2019-2989
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://access.redhat.com/errata/RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:3157 https&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2019-2987 – OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286)
https://notcve.org/view.php?id=CVE-2019-2987
Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://access.redhat.com/errata/RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:3157 https&# • CWE-20: Improper Input Validation •
CVSS: 3.1EPSS: 0%CPEs: 37EXPL: 0CVE-2019-2945 – OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573)
https://notcve.org/view.php?id=CVE-2019-2945
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00031.html http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://access.redhat.com/errata/RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:3157 https&# •