Sun j2ee vulnerabilities

3 CVEs affecting Sun j2ee, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-2705, published 2009-08-11.

More from Sun.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2003-1573, published 2009-06-01. High severity, CVSS 10.0. EPSS: 5% chance of exploitation in the next 30 days. The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive…
• CVE-2009-2705, published 2009-08-11. Medium severity, CVSS 4.3. EPSS: 4.4% chance of exploitation in the next 30 days. CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-canonical, "overlong Unicode" in place of blacklisted…
• CVE-2009-2704, published 2009-08-11. Medium severity, CVSS 4.3. EPSS: 3.9% chance of exploitation in the next 30 days. CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing a %00 (encoded null byte).