CVSS: 8.3EPSS: 5%CPEs: 12EXPL: 0CVE-2008-3105 – OpenJDK JAX-WS unauthorized URL access (6542088)
https://notcve.org/view.php?id=CVE-2008-3105
Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application. Vulnerabilidad no especificada en el cliente y servicio JAX-WS de Sun Java Runtime Environment (JRE), de JDK y JRE 6 Update 6 y anteriores permite a atacantes remotos acceder a URLs o provocar una denegación de servicio mediante vectores desconocidos que involucra "procesado de datos XML" por una aplicación de confianza. • http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html http://marc.info/?l=bugtraq&m=122331139823057&w=2 http://secunia.com/advisories/31010 http://secunia.com/advisories/31600 http://secunia.com/advisories/32018 http://secunia.com/advisories/32179 http://secunia.com/advisories/32180 http://secunia.com/advisories/32436 http://secunia.com/advisories/33237 http://secunia.com/advisories& • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2008-1191 – Untrusted Java Web Start arbitrary file creation
https://notcve.org/view.php?id=CVE-2008-1191
Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier allows remote attackers to create arbitrary files via an untrusted application, a different issue than CVE-2008-1190, aka "The fifth issue." Una vulnerabilidad no especificada en Java Web Start en Sun JDK y JRE versión 6 Update 4 y anteriores, permite a atacantes remotos crear archivos arbitrarios por medio de una aplicación no confiable, un problema diferente de CVE-2008-1190, también se conoce como "The fifth issue". • http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html http://secunia.com/advisories/29239 http://secunia.com/advisories/29273 http://secunia.com/advisories/29582 http://secunia.com/advisories/29858 http://secunia.com/advisories/30676 http://secunia.com/advisories/30780 http://secunia.com/advisories/32018 http://security.gentoo.org/glsa/glsa-200804-28.xml http://sunsolve.sun.com/sear •
CVSS: 6.8EPSS: 10%CPEs: 70EXPL: 0CVE-2008-1187 – Untrusted applet and application XSLT processing privilege escalation
https://notcve.org/view.php?id=CVE-2008-1187
Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors related to XSLT transforms. Una vulnerabilidad no especificada en Sun Java Runtime Environment (JRE) y JDK versión 6 Update 4 y anteriores, versión 5.0 Update 14 y anteriores, y SDK/JRE versión 1.4.2_16 y anteriores, permite a atacantes remotos causar una denegación de servicio (bloqueo de JRE) y posiblemente ejecutar código arbitrario por medio de vectores desconocidos relacionados con las transformaciones XSLT. • http://dev2dev.bea.com/pub/advisory/277 http://download.novell.com/Download?buildid=q5exhSqeBjA~ http://jvn.jp/en/jp/JVN04032535/index.html http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000016.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html http://secunia.com/advisories/29239 http://secunia.com/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 0CVE-2007-3716
https://notcve.org/view.php?id=CVE-2007-3716
The Java XML Digital Signature implementation in Sun JDK and JRE 6 before Update 2 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715. La implementación de Java XML Digital Signature en Sun JDK y JRE versión 6 anterior a Update 2, no procesa apropiadamente hojas de estilo XSLT en las transformaciones de XSLT en firmas XSLT, lo que permite a atacantes dependiendo del contexto ejecutar código arbitrario por medio de una hoja de estilo diseñada, un problema relacionado con CVE-2007-3715. • http://dev2dev.bea.com/pub/advisory/248 http://osvdb.org/36664 http://secunia.com/advisories/26031 http://secunia.com/advisories/26631 http://secunia.com/advisories/26933 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102993-1 http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml http://www.isecpartners.com/advisories/2007-04-dsig.txt http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf http://www.securityfocus.com/archive/1/473552/100/0/thr • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 12EXPL: 0CVE-2006-0614
https://notcve.org/view.php?id=CVE-2006-0614
Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 3 and earlier, SDK and JRE 1.3.x through 1.3.1_16 and 1.4.x through 1.4.2_08 allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "first issue." • http://docs.info.apple.com/article.html?artnum=303658 http://secunia.com/advisories/18760 http://secunia.com/advisories/18884 http://securitytracker.com/id?1015596 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102171-1 http://www.gentoo.org/security/en/glsa/glsa-200602-07.xml http://www.kb.cert.org/vuls/id/759996 http://www.vupen.com/english/advisories/2006/0467 http://www.vupen.com/english/advisories/2006/0828 http://www.vupen.com/english/advisories/ •