CVSS: 6.8EPSS: 0%CPEs: 116EXPL: 0CVE-2008-1192 – Java Plugin same-origin-policy bypass
https://notcve.org/view.php?id=CVE-2008-1192
Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote attackers to bypass the same origin policy and "execute local applications" via unknown vectors. Una vulnerabilidad no especificada en el Plug-in de Java para Sun JDK y JRE versión 6 Update 4 y anteriores, y versión 5.0 Update 14 y anteriores; y SDK y JRE versión 1.4.2_16 y anteriores, y versión 1.3.1_21 y anteriores; permite a atacantes remotos omitir la política del mismo origen y "execute local applications" por medio de vectores desconocidos. • http://dev2dev.bea.com/pub/advisory/277 http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html http://secunia.com/advisories/29239 http://secunia.com/advisories/29273 http://secunia.com/advisories/29498 http://secunia.com/advisories/29582 http://secunia.com/advisories/29841 http://secunia.com/advisories/29858 http: • CWE-254: 7PK - Security Features •
CVSS: 6.8EPSS: 10%CPEs: 70EXPL: 0CVE-2008-1187 – Untrusted applet and application XSLT processing privilege escalation
https://notcve.org/view.php?id=CVE-2008-1187
Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors related to XSLT transforms. Una vulnerabilidad no especificada en Sun Java Runtime Environment (JRE) y JDK versión 6 Update 4 y anteriores, versión 5.0 Update 14 y anteriores, y SDK/JRE versión 1.4.2_16 y anteriores, permite a atacantes remotos causar una denegación de servicio (bloqueo de JRE) y posiblemente ejecutar código arbitrario por medio de vectores desconocidos relacionados con las transformaciones XSLT. • http://dev2dev.bea.com/pub/advisory/277 http://download.novell.com/Download?buildid=q5exhSqeBjA~ http://jvn.jp/en/jp/JVN04032535/index.html http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000016.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html http://secunia.com/advisories/29239 http://secunia.com/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 4EXPL: 0CVE-2008-0657 – java-1.5.0 Privilege escalation via unstrusted applet and application
https://notcve.org/view.php?id=CVE-2008-0657
Multiple unspecified vulnerabilities in the Java Runtime Environment in Sun JDK and JRE 6 Update 1 and earlier, and 5.0 Update 13 and earlier, allow context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs. Múltiples vulnerabilidades no especificadas en el Java Runtime Environment en Sun JDK y JRE 6 Update 1 y versiones anteriores y 5.0 Update 13 y versiones anteriores, permite a atacantes según contexto conseguir privilegios a través de (1) aplicación o (2) applet no confiables, como se demostró por una aplicación o applet que garantiza de por sí privilegios de (a) lectura en archivos locales (b) escritura en archivos locales, o (c) ejecución de programas locales. • http://dev2dev.bea.com/pub/advisory/277 http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html http://secunia.com/advisories/28795 http://secunia.com/advisories/28888 http://secunia.com/advisories/29214 http://secunia.com/advisories/29498 http://secunia.com/advisories/29841 http://secunia.com/advisories/29858 http://secunia.com/advisories/29897 http://secunia.com/advisories/30676 http://secunia.com/advisories/30780 http://secunia.com/advisories/31497 http • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2008-0628 – java-1.6.0 default external entity processing
https://notcve.org/view.php?id=CVE-2008-0628
The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources. El código de análisis sintáctico de XML en Sun Java Runtime Environment JDK y JRE 6 actualización 3 y anteriores. Procesa referencias a entidades externas incluso cuando la propiedad "external general entities (entidades generales externas)" es falsa, lo que permite a atacantes remotos llevar a cabo ataques de entidades externas XML (XXE) y provocar una denegación de servicio o acceso restringido a recursos. • http://dev2dev.bea.com/pub/advisory/277 http://scary.beasts.org/security/CESA-2007-002.html http://secunia.com/advisories/28746 http://secunia.com/advisories/29841 http://secunia.com/advisories/29858 http://secunia.com/advisories/30780 http://security.gentoo.org/glsa/glsa-200804-28.xml http://securityreason.com/securityalert/3621 http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1 http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml http://www. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 7%CPEs: 7EXPL: 0CVE-2007-0012
https://notcve.org/view.php?id=CVE-2007-0012
Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM. Sun JRE 5.0 anterior al update 14 permite a atacantes remotos provocar una denegación de servicio (caída de Internet Explorer) mediante una etiqueta object con un applet codificado y un atributo name no definido, lo cual dispara una referencia a puntero nulo en jpiexp32.dll cuando el applet es decodificado y pasado a la JVM. • http://securityreason.com/securityalert/3527 http://www.securityfocus.com/archive/1/485942/100/0/threaded http://www.securityfocus.com/bid/27185 https://exchange.xforce.ibmcloud.com/vulnerabilities/39549 • CWE-20: Improper Input Validation •