CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25738 – Code exec via yaml parsing
https://notcve.org/view.php?id=CVE-2021-25738
11 Oct 2021 — Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. Una carga de yaml especialmente diseñado con la librería Kubernetes Java Client puede conllevar a una ejecución de código • http://www.openwall.com/lists/oss-security/2022/08/23/2 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8570 – Kubernetes Java client libraries unvalidated path traversal in Copy implementation
https://notcve.org/view.php?id=CVE-2020-8570
21 Jan 2021 — Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code. Las bibliotecas del cliente de Kubernetes Java en la versión 10.0.0 y las versiones anteriores a 9.0.1, permiten la escritura en rutas fuera del directorio actual cuando copia varios archivos ... • https://github.com/kubernetes-client/java/issues/1491 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2019-4473
https://notcve.org/view.php?id=CVE-2019-4473
05 Aug 2019 — Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984. Múltiples archivos binarios en el SDK de IBM , Java Technology Edition versiones 7, 7R y 8, en la plataforma AIX usan RPATH absolutos no seguros, que puede facilitar la inyección de código y la escalada de privilegios por parte de los usuarios locales. ID de IBM X-Force: 163984. • http://www.ibm.com/support/docview.wss?uid=ibm10960422 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 2%CPEs: 27EXPL: 0CVE-2015-0192 – JDK: unspecified Java sandbox restrictions bypass
https://notcve.org/view.php?id=CVE-2015-0192
13 May 2015 — Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine. Vulnerabilidad no especificada en IBM Java 8 anterior a SR1, 7 R1 anterior a SR2 FP11, 7 anterior a SR9, 6 R1 anterior a SR8 FP4, 6 anterior a SR16 FP4, y 5.0 anterior a SR16 FP10 permite a atacantes remotos ganar privilegios a través de vectores desconocidos... • http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-1914 – JDK: unspecified partial Java sandbox restrictions bypass
https://notcve.org/view.php?id=CVE-2015-1914
13 May 2015 — IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine. IBM Java 7 R1 anterior a SR3, 7 anterior a SR9, 6 R1 anterior a SR8 FP4, 6 anterior a SR16 FP4, y 5.0 anterior a SR16 FP10 permite a atacantes remotos evadir 'comprobaciones de permisos' y obtener información sensible a través de vectores relacionados con Java Virtual Ma... • http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 46EXPL: 0CVE-2014-3068 – JDK: Java CMS keystore provider potentially allows brute-force private key recovery
https://notcve.org/view.php?id=CVE-2014-3068
02 Dec 2014 — IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16 FP1 (6.0.16.1), and before 5.0 SR16 FP7 (5.0.16.7) allows attackers to obtain the private key from a Certificate Management System (CMS) keystore via a brute force attack. IBM Java Runtime Environment (JRE) 7 R1 anterior a SR1 FP1 (7.1.1.1), 7 anterior a SR7 FP1 (7.0.7.1), 6 R1 anterior a SR8 FP1 (6.1.8.1), 6 anterior a SR16 FP1 (6.0.16.1), y anterior a 5.0 SR16 FP7 (5.0... • http://rhn.redhat.com/errata/RHSA-2015-0264.html • CWE-255: Credentials Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 46EXPL: 0CVE-2014-3065 – JDK: privilege escalation via shared class cache
https://notcve.org/view.php?id=CVE-2014-3065
20 Nov 2014 — Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache. Vulnerabilidad no especificada en IBM Java Runtime Environment (JRE) 7 R1 anterior a SR2 (7.1.2.0), 7 anterior a SR8 (7.0.8.0), 6 R1 anterior a SR8 FP2 (6.1.8.2), 6 anterior a SR16 FP2 (6.0.16.2), y anterior a S... • http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.8EPSS: 0%CPEs: 53EXPL: 0CVE-2014-0878 – JDK: Vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic providers
https://notcve.org/view.php?id=CVE-2014-0878
26 May 2014 — The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the random number generator's output. El componente IBMSecureRandom en los proveedores criptográficos IBMJCE y IBMSecureRand... • http://secunia.com/advisories/59022 • CWE-310: Cryptographic Issues •
CVSS: 7.1EPSS: 1%CPEs: 101EXPL: 1CVE-2013-4002 – OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
https://notcve.org/view.php?id=CVE-2013-4002
23 Jul 2013 — XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute... • https://github.com/tafamace/CVE-2013-4002 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 3%CPEs: 7EXPL: 0CVE-2013-3006 – JDK: Unspecified security fixes (July 2013)
https://notcve.org/view.php?id=CVE-2013-3006
23 Jul 2013 — Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 7 before 7 SR5 allows remote attackers to affect confidentiality, availability, and integrity via unknown vectors, a different vulnerability than CVE-2013-3008. Vulnerabilidad sin especificar en Java Runtime Environment (JRE) en IBM Java 7 anterior a 7 SR5, permite a atacantes remotos comprometer la disponibilidad, confidencialidad e integridad a través de vectores no especificados. Vulnerabilidad distinta de CVE-2013-3008. • http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html •