CVSS: 9.3EPSS: 19%CPEs: 157EXPL: 1CVE-2004-1029 – Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass
https://notcve.org/view.php?id=CVE-2004-1029
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages. • https://www.exploit-db.com/exploits/24763 http://jouko.iki.fi/adv/javaplugin.html http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html http://secunia.com/advisories/13271 http://secunia.com/advisories/29035 http://securityreason.com/securityalert/61 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1 http://sunsolve.sun.co • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 2%CPEs: 60EXPL: 2CVE-2003-1123 – Sun JRE/SDK 1.x - Untrusted Applet Java Security Model Violation
https://notcve.org/view.php?id=CVE-2003-1123
Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model. • https://www.exploit-db.com/exploits/22732 http://secunia.com/advisories/8958 http://securitytracker.com/id?1006935 http://sunsolve.sun.com/search/document.do?assetkey=1-26-55100-1 http://www.kb.cert.org/vuls/id/393292 http://www.securityfocus.com/bid/7824 https://exchange.xforce.ibmcloud.com/vulnerabilities/12189 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2003-1229
https://notcve.org/view.php?id=CVE-2003-1229
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files. • http://archives.neohapsis.com/archives/bugtraq/2003-01/0334.html http://java.sun.com/products/jsse/CHANGES.txt http://secunia.com/advisories/7943 http://securitytracker.com/id?1006007 http://securitytracker.com/id?1007483 http://sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1 http://www.securityfocus.com/bid/6682 http://www.securitytracker.com/id?1006001 http://www1.itrc.hp.com/service/cki/docDisplay.do? • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 10%CPEs: 1EXPL: 1CVE-2003-0896 – Sun Java Virtual Machine 1.x - Slash Path Security Model Circumvention
https://notcve.org/view.php?id=CVE-2003-0896
The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method. El método loadClass de la clase sun.applet.AppletClassLoader en la Máquina Virtual de Java (JVM) en Sun SDK y JRE 1.4.1_03 y anteriores permite a atacantes remotos saltarles las restricciones del cajón de arena de Java y ejecutar código mediante una clase cargada que contenga caractéres "/" (barra) en lugar de "." punto, lo que evita la llamada al método del Adminstrador de Seguridad checkPackageAccess. • https://www.exploit-db.com/exploits/23276 http://lsd-pl.net/code/JVM/jre.tar.gz http://marc.info/?l=bugtraq&m=106692334503819&w=2 http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200356-1 http://www.securityfocus.com/advisories/6028 http://www.securityfocus.com/archive/1/342580 http://www.securityfocus.com/archive/1/342583 http://www.securityfocus.com/bid/8879 •
CVSS: 5.0EPSS: 2%CPEs: 2EXPL: 3CVE-2002-2072 – Sun Java Virtual Machine 1.2.2/1.3.1 - Segmentation Violation
https://notcve.org/view.php?id=CVE-2002-2072
java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument. • https://www.exploit-db.com/exploits/21259 http://ohhara.sarang.net/security/jvmcrash.txt http://securitytracker.com/id?1003418 http://www.iss.net/security_center/static/8042.php http://www.securityfocus.com/bid/3992 •