ByteOS

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.23% / 79.27%

||

7 Day CHG~0.00%

Published-16 Jul, 2018 | 18:00

Updated-05 Aug, 2024 | 09:21

The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOTE: this is not an Oracle supported product.

Product-glassfish_server n/a

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2003-1208

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-8.38% / 92.33%

||

7 Day CHG~0.00%

Published-19 May, 2005 | 04:00

Updated-16 Apr, 2026 | 00:27

Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.

Product-oracle9i n/a

CVE-2008-4006

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-1.77% / 82.77%

||

7 Day CHG~0.00%

Published-14 Jan, 2009 | 01:00

Updated-23 Apr, 2026 | 00:35

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.1.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Product-secure_backup n/a

CVE-2020-2884

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-3.87% / 88.28%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 18:54

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server

CVE-2020-2961

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-1.56% / 81.56%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-27 Sep, 2024 | 18:45

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Supported versions that are affected are 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-enterprise_manager_base_platform Enterprise Manager Base Platform

CVE-2020-2883

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.36% / 99.96%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-12 Jan, 2026 | 21:02

Known KEV||Action Due Date - 2025-01-28||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server WebLogic Server

CVE-2020-2801

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-4.49% / 89.16%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-30 Sep, 2024 | 14:55

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: The patch for this issue will address the vulnerability only if the WLS instance is using JDK 1.7.0_191 or later, or JDK 1.8.0_181 or later. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-jdk weblogic_server WebLogic Server

CVE-2020-2733

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-88.88% / 99.53%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 13:29

Updated-30 Sep, 2024 | 14:54

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CVE-2020-2551

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-94.41% / 99.98%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:34

Updated-12 Jan, 2026 | 21:12

Known KEV||Action Due Date - 2023-12-07||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server Fusion Middleware

CVE-2020-2555

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-93.14% / 99.80%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:34

Updated-27 Oct, 2025 | 17:08

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-webcenter_portal commerce_platform utilities_framework healthcare_data_repository retail_assortment_planning coherence rapid_planning access_manager communications_diameter_signaling_router WebCenter Portal Utilities Framework Multiple Products

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-2546

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-26.77% / 96.37%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:34

Updated-30 Sep, 2024 | 17:25

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-weblogic_server WebLogic Server

CVE-2014-7169

Matching Score-8

Assigner-MITRE Corporation

Vendor-mageia n/a Canonical Ltd.Apple Inc.GNU IBM Corporation Oracle Corporation F5, Inc.Novell openSUSE Check Point Software Technologies Ltd.Citrix (Cloud Software Group, Inc.)QNAP Systems, Inc.SUSE Red Hat, Inc.Debian GNU/Linux VMware (Broadcom Inc.)Arista Networks, Inc.

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-90.11% / 99.59%

||

7 Day CHG~0.00%

Published-25 Sep, 2014 | 01:00

Updated-22 Apr, 2026 | 14:32

Known KEV||Action Due Date - 2022-07-28||Apply updates per vendor instructions.

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Product-big-ip_application_acceleration_manager big-ip_advanced_firewall_manager stn6800 storwize_v7000_firmware enterprise_linux_for_ibm_z_systems bash mageia big-ip_wan_optimization_manager storwize_v3500 stn7800_firmware big-ip_protocol_security_module enterprise_linux_server enterprise_linux_workstation storwize_v3700 storwize_v3700_firmware big-ip_global_traffic_manager gluster_storage_server_for_on-premise big-ip_edge_gateway opensuse storwize_v3500_firmware enterprise_manager traffix_signaling_delivery_controller big-iq_device vcenter_server_appliance enterprise_linux_desktop stn7800 san_volume_controller linux_enterprise_server security_access_manager_for_web_8.0_firmware enterprise_linux_server_aus san_volume_controller_firmware software_defined_network_for_virtual_environments big-iq_cloud linux_enterprise_software_development_kit netscaler_sdx qts big-ip_analytics big-ip_local_traffic_manager studio_onsite big-ip_access_policy_manager linux infosphere_guardium_database_activity_monitoring qradar_risk_manager ubuntu_linux arx eos enterprise_linux_server_tus big-iq_security qradar_vulnerability_manager stn6500 enterprise_linux_server_from_rhui stn6800_firmware flex_system_v7000 flex_system_v7000_firmware netscaler_sdx_firmware stn6500_firmware storwize_v5000 security_access_manager_for_mobile_8.0_firmware starter_kit_for_cloud enterprise_linux_eus virtualization security_access_manager_for_web_7.0_firmware smartcloud_entry_appliance big-ip_application_security_manager debian_linux linux_enterprise_desktop mac_os_x zenworks_configuration_management esx big-ip_webaccelerator enterprise_linux_for_power_big_endian_eus enterprise_linux_for_power_big_endian workload_deployer qradar_security_information_and_event_manager arx_firmware storwize_v5000_firmware security_gateway big-ip_policy_enforcement_manager smartcloud_provisioning pureapplication_system storwize_v7000 open_enterprise_server enterprise_linux_for_scientific_computing big-ip_link_controller enterprise_linux n/a Bourne-Again Shell (Bash)

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2015-0469

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-8.62% / 92.46%

||

7 Day CHG~0.00%

Published-16 Apr, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Product-jre jdk n/a

CVE-2020-1747

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.85% / 83.08%

||

7 Day CHG~0.00%

Published-24 Mar, 2020 | 13:56

Updated-04 Aug, 2024 | 06:46

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Vendor-pyyaml openSUSE Red Hat, Inc.Fedora Project Oracle Corporation

Product-communications_cloud_native_core_network_function_cloud_native_environment fedora pyyaml leap PyYAML

CWE ID-CWE-20

Improper Input Validation

CVE-2018-14720

Matching Score-8

Assigner-MITRE Corporation

Product-debian_linux primavera_unifier communications_billing_and_revenue_management jackson-databind enterprise_manager_for_virtualization financial_services_analytical_applications_infrastructure openshift_container_platform jdeveloper banking_platform jboss_enterprise_application_platform retail_merchandising_system webcenter_portal n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-3.35% / 87.37%

||

7 Day CHG~0.00%

Published-02 Jan, 2019 | 18:00

Updated-05 Aug, 2024 | 09:38

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Vendor-n/a Red Hat, Inc.Oracle Corporation FasterXML, LLC.Debian GNU/Linux

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2014-1478

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-10||HIGH

EPSS-1.23% / 79.27%

||

7 Day CHG~0.00%

Published-06 Feb, 2014 | 02:00

Updated-29 Apr, 2026 | 01:13

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.

Vendor-n/a Canonical Ltd.openSUSE Oracle Corporation Mozilla Corporation

Product-firefox ubuntu_linux seamonkey solaris opensuse n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-1292

Matching Score-8

Assigner-OpenSSL Software Foundation

Matching Score-8

Assigner-OpenSSL Software Foundation

CVSS Score-9.8||CRITICAL

EPSS-37.78% / 97.23%

||

7 Day CHG-1.20%

Published-03 May, 2022 | 15:15

Updated-30 Dec, 2025 | 04:55

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Vendor-NetApp, Inc.OpenSSL Oracle Corporation Fedora Project Debian GNU/Linux Siemens AG

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2014-1528

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-10||HIGH

EPSS-1.26% / 79.52%

||

7 Day CHG~0.00%

Published-30 Apr, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element.

Vendor-n/a Mozilla Corporation openSUSE Fedora Project Canonical Ltd.Oracle Corporation Microsoft Corporation

Product-solaris firefox opensuse seamonkey ubuntu_linux fedora windows n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2014-2405

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-0.61% / 69.80%

||

7 Day CHG~0.00%

Published-14 May, 2014 | 00:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.

Vendor-n/a Debian GNU/Linux Oracle Corporation Canonical Ltd.

Product-debian_linux ubuntu_linux openjdk n/a

CVE-2014-2421

Matching Score-8

Assigner-Oracle

Vendor-n/a Juniper Networks, Inc.IBM Corporation Canonical Ltd.Debian GNU/Linux Oracle Corporation Microsoft Corporation

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-5.91% / 90.65%

||

7 Day CHG+0.08%

Published-16 Apr, 2014 | 02:05

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Product-junos_space jrockit ubuntu_linux jdk forms_viewer windows debian_linux jre n/a

CVE-2020-14855

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-5.09% / 89.85%

||

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:10

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Product-universal_work_queue Universal Work Queue

CVE-2014-1488

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-10||HIGH

EPSS-1.09% / 78.02%

||

7 Day CHG~0.00%

Published-06 Feb, 2014 | 02:00

Updated-29 Apr, 2026 | 01:13

The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.

Vendor-n/a Canonical Ltd.openSUSE Oracle Corporation SUSE Mozilla Corporation

Product-firefox ubuntu_linux seamonkey linux_enterprise_desktop solaris linux_enterprise_server linux_enterprise_software_development_kit opensuse n/a

CVE-2014-1563

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-10||HIGH

EPSS-1.44% / 80.81%

||

7 Day CHG~0.00%

Published-03 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.

Vendor-n/a Mozilla Corporation Oracle Corporation openSUSE

Product-solaris firefox opensuse evergreen thunderbird n/a

CWE ID-CWE-416

Use After Free

CVE-2014-0456

Matching Score-8

Assigner-Oracle

Vendor-n/a Juniper Networks, Inc.IBM Corporation Canonical Ltd.Debian GNU/Linux Oracle Corporation Microsoft Corporation

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-5.91% / 90.65%

||

7 Day CHG+0.08%

Published-16 Apr, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Product-junos_space jrockit ubuntu_linux jdk forms_viewer windows debian_linux jre n/a

CVE-2014-0429

Matching Score-8

Assigner-Oracle

Vendor-n/a Juniper Networks, Inc.IBM Corporation Canonical Ltd.Debian GNU/Linux Oracle Corporation Microsoft Corporation

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-6.90% / 91.44%

||

7 Day CHG-3.37%

Published-15 Apr, 2014 | 22:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Product-junos_space jrockit ubuntu_linux jdk forms_viewer windows debian_linux jre n/a

CVE-2014-0462

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-0.61% / 69.80%

||

7 Day CHG~0.00%

Published-14 May, 2014 | 00:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.

Vendor-n/a Debian GNU/Linux Oracle Corporation Canonical Ltd.

Product-debian_linux ubuntu_linux openjdk n/a

CVE-2014-0422

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-8.13% / 92.19%

||

7 Day CHG~0.00%

Published-15 Jan, 2014 | 02:50

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.

Product-jdk jre n/a

CVE-2014-0457

Matching Score-8

Assigner-Oracle

Vendor-n/a Juniper Networks, Inc.IBM Corporation Canonical Ltd.Debian GNU/Linux Oracle Corporation Microsoft Corporation

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-11.17% / 93.53%

||

7 Day CHG+3.36%

Published-16 Apr, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

Product-junos_space jrockit ubuntu_linux jdk forms_viewer windows debian_linux jre n/a

CVE-2014-0410

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-5.42% / 90.19%

||

7 Day CHG~0.00%

Published-15 Jan, 2014 | 02:50

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.

Product-jre jdk n/a

CVE-2008-0341

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-2.30% / 84.81%

||

7 Day CHG~0.00%

Published-17 Jan, 2008 | 22:00

Updated-23 Apr, 2026 | 00:35

Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.0.1.5 FIPS+ and 10.1.0.5 has unknown impact and remote attack vectors, aka DB03.

Product-database_server n/a

CVE-2013-5830

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-6.35% / 91.04%

||

7 Day CHG-0.61%

Published-16 Oct, 2013 | 17:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

Vendor-n/a Canonical Ltd.Red Hat, Inc.Oracle Corporation

Product-jrockit ubuntu_linux jdk jre enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop enterprise_linux_server_aus enterprise_linux_eus n/a

CVE-2013-5787

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-4.84% / 89.57%

||

7 Day CHG~0.00%

Published-16 Oct, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5789, CVE-2013-5824, CVE-2013-5832, and CVE-2013-5852.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jdk jre n/a

CVE-2021-42392

Matching Score-8

Assigner-JFrog

Matching Score-8

Assigner-JFrog

CVSS Score-9.8||CRITICAL

EPSS-90.59% / 99.62%

||

7 Day CHG-0.45%

Published-07 Jan, 2022 | 00:00

Updated-04 Aug, 2024 | 03:30

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Vendor-h2database h2database Oracle Corporation Debian GNU/Linux

Product-communications_cloud_native_core_policy debian_linux h2 h2

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2013-5824

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-4.84% / 89.57%

||

7 Day CHG~0.00%

Published-16 Oct, 2013 | 17:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5787, CVE-2013-5789, CVE-2013-5832, and CVE-2013-5852.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jdk jre n/a

CVE-2013-5842

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-17.11% / 95.03%

||

7 Day CHG-3.16%

Published-16 Oct, 2013 | 17:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5850.

Vendor-n/a Canonical Ltd.Red Hat, Inc.Oracle Corporation

Product-ubuntu_linux enterprise_linux_server jdk jre enterprise_linux_workstation enterprise_linux_desktop enterprise_linux_server_aus enterprise_linux_eus n/a

CVE-2013-5809

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-10.71% / 93.36%

||

7 Day CHG+2.91%

Published-16 Oct, 2013 | 17:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5829.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-5788

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-1.09% / 78.07%

||

7 Day CHG~0.00%

Published-16 Oct, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Product-jdk jre n/a

CVE-2013-5610

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-10||HIGH

EPSS-0.88% / 75.45%

||

7 Day CHG~0.00%

Published-11 Dec, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Vendor-n/a Canonical Ltd.openSUSE Oracle Corporation SUSE Mozilla Corporation Fedora Project

Product-firefox ubuntu_linux seamonkey linux_enterprise_desktop solaris linux_enterprise_server fedora linux_enterprise_software_development_kit opensuse n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2013-5817

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-7.77% / 91.98%

||

7 Day CHG+1.41%

Published-16 Oct, 2013 | 17:31

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jdk jre n/a

CVE-2013-5907

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-16.60% / 94.94%

||

7 Day CHG~0.00%

Published-15 Jan, 2014 | 01:33

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.

Product-jrockit jdk jre n/a

CVE-2013-5789

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-4.84% / 89.57%

||

7 Day CHG~0.00%

Published-16 Oct, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5787, CVE-2013-5824, CVE-2013-5832, and CVE-2013-5852.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-5782

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-7.77% / 91.98%

||

7 Day CHG+1.41%

Published-16 Oct, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jrockit jre jdk n/a

CVE-2013-2420

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-6.27% / 90.97%

||

7 Day CHG~0.00%

Published-17 Apr, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to insufficient "validation of images" in share/native/sun/awt/image/awt_ImageRep.c, possibly involving offsets.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-2472

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-54.41% / 98.04%

||

7 Day CHG~0.00%

Published-18 Jun, 2013 | 22:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2007-5561

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-3.65% / 87.91%

||

7 Day CHG~0.00%

Published-18 Oct, 2007 | 20:00

Updated-23 Apr, 2026 | 00:35

Format string vulnerability in the logging function in the Oracle OPMN daemon, as used on Oracle Enterprise Grid Console server 10.2.0.1, allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP request to port 6003, aka Oracle reference number 6296175. NOTE: this might be the same issue as CVE-2007-0282 or CVE-2007-0280, but there are insufficient details to be sure.

Product-opmn_daemon enterprise_grid_console_server n/a

CWE ID-CWE-134

Use of Externally-Controlled Format String

CVE-2013-2463

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-44.66% / 97.59%

||

7 Day CHG~0.00%

Published-18 Jun, 2013 | 22:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-2459

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-15.52% / 94.70%

||

7 Day CHG~0.00%

Published-18 Jun, 2013 | 22:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks."

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-2380

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-2.53% / 85.52%

||

7 Day CHG~0.00%

Published-17 Apr, 2013 | 14:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware R27.7.4 and earlier and R28.2.6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this might be a duplicate of CVE-2013-1537 and CVE-2013-2415. If so, then CVE-2013-2380 might be REJECTed in the future.

Product-jrockit fusion_middleware n/a

CVE-2013-2440

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-6.52% / 91.16%

||

7 Day CHG~0.00%

Published-17 Apr, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2435.

Vendor-n/a Oracle Corporation Sun Microsystems (Oracle Corporation)

Product-jre jdk n/a

CVE-2013-2428

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-10||HIGH

EPSS-1.57% / 81.62%

||

7 Day CHG~0.00%

Published-17 Apr, 2013 | 15:00

Updated-29 Apr, 2026 | 01:13

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2427.