CVSS: 6.5EPSS: 1%CPEs: 429EXPL: 0CVE-2019-10219 – hibernate-validator: safeHTML validator allows XSS
https://notcve.org/view.php?id=CVE-2019-10219
08 Nov 2019 — A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. Una vulnerabilidad fue encontrada en Hibernate-Validator. La anotación del validador SafeHtml no puede sanear apropiadamente las cargas útiles que consisten en código potencialmente malicioso en los comentarios e instrucciones HTML. • https://access.redhat.com/errata/RHSA-2020:0159 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 68EXPL: 0CVE-2013-4578 – OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars
https://notcve.org/view.php?id=CVE-2013-4578
29 Dec 2017 — jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation. jarsigner en OpenJDK y Oracle Java SE en versiones anteriores a la 7u51 permite que atacantes remotos omitan un mecanismo de protección de firma de código e inyecten código de bytes no firmado en un archivo JAR firmado aprovechando la validación incorrecta de archivos. • http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927e • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 10%CPEs: 11EXPL: 0CVE-2015-0459 – JDK: unspecified vulnerability fixed in 5.0u85, 6u95, 7u79 and 8u45 (2D)
https://notcve.org/view.php?id=CVE-2015-0459
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40, y JavaFX 2.2.76, permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con 2D, una vulnerabilidad ... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00017.html •
CVSS: 10.0EPSS: 8%CPEs: 11EXPL: 0CVE-2015-0491 – JDK: unspecified vulnerability fixed in 5.0u85, 6u95, 7u79 and 8u45 (2D)
https://notcve.org/view.php?id=CVE-2015-0491
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40, y Java FX 2.2.76, permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con 2D, una vulnerabilida... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00017.html •
CVSS: 9.8EPSS: 5%CPEs: 11EXPL: 0CVE-2015-0492 – JDK: unspecified vulnerability fixed in 7u79 and 8u45 (JavaFX)
https://notcve.org/view.php?id=CVE-2015-0492
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484. Vulnerabilidad no especificada en Oracle Java SE 7u76 y 8u40, y JavaFX 2.2.76, permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos, una vulnerabilidad diferente a CVE-2015-0484. Oracle Java SE version 7 includes the... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00017.html •
CVSS: 9.8EPSS: 7%CPEs: 8EXPL: 0CVE-2015-0460 – OpenJDK: incorrect handling of phantom references (Hotspot, 8071931)
https://notcve.org/view.php?id=CVE-2015-0460
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Hotspot. A flaw was found in the way the Hotspot component in OpenJDK handled phantom references. An u... • http://advisories.mageia.org/MGASA-2015-0158.html •
CVSS: 10.0EPSS: 9%CPEs: 8EXPL: 0CVE-2015-0469 – ICU: layout engine glyphStorage off-by-one (OpenJDK 2D, 8067699)
https://notcve.org/view.php?id=CVE-2015-0469
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con 2D. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D componen... • http://advisories.mageia.org/MGASA-2015-0158.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 2%CPEs: 8EXPL: 0CVE-2015-0477 – OpenJDK: incorrect permissions check in resource loading (Beans, 8068320)
https://notcve.org/view.php?id=CVE-2015-0477
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40 permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con Beans. A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. An off-by... • http://advisories.mageia.org/MGASA-2015-0158.html •
CVSS: 5.9EPSS: 3%CPEs: 9EXPL: 0CVE-2015-0478 – OpenJDK: insufficient hardening of RSA-CRT implementation (JCE, 8071726)
https://notcve.org/view.php?id=CVE-2015-0478
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40, y JRockit R28.3.5, permite a atacantes remotos afectar la confidencialidad a través de vectores relacionados con JCE. It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures. A... • http://advisories.mageia.org/MGASA-2015-0158.html • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 9.1EPSS: 5%CPEs: 8EXPL: 0CVE-2015-0480 – OpenJDK: jar directory traversal issues (Tools, 8064601)
https://notcve.org/view.php?id=CVE-2015-0480
16 Apr 2015 — Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools. Vulnerabilidad no especificada en Oracle Java SE 5.0u81, 6u91, 7u76, y 8u40 permite a atacantes remotos afectar la integridad y la disponibilidad a través de vectores desconocidos relacionados con Tools. A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause ja... • http://advisories.mageia.org/MGASA-2015-0158.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •