Sun Java vulnerabilities

14 CVEs affecting Sun Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2010-0887, published 2010-04-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-0887, published 2010-04-20. High severity, CVSS 10.0. EPSS: 9.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and…
CVE-2009-1102, published 2009-03-25. Medium severity, CVSS 6.4. EPSS: 4.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute…
CVE-2009-1103, published 2009-03-25. Medium severity, CVSS 6.4. EPSS: 4.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and…
CVE-1999-0440, published 1999-03-01. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages.
CVE-2009-1105, published 2009-03-25. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run in an older JRE…
CVE-2009-1107, published 2009-03-25. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a user into trusting a…
CVE-2005-2530, published 2005-12-31. High severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. Unspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specific extensions."
CVE-2008-3440, published 2008-08-01. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a…
CVE-2005-2529, published 2005-12-31. High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to "the utility used to update Java…
CVE-2009-1104, published 2009-03-25. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is…

Latest

CVE-2005-2738, published 2005-12-31. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X does not prevent multiple programs from opening the same port as a Java ServerSocket, which allows local users to operate a Java program that…