VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Advisory: Java SE CPU Mar 2010✕
Overview 4 matches, all public PoC, all EPSS ≥ 0.5 · 3 in RASP scope · 2 protected · 1 KEV · 2 CISA SSVC · 0 disputed
4matches, all public PoC, all EPSS ≥ 0.5 3in RASP scope75.0% 2protected50.0% 1KEV25.0% 2CISA SSVC50.0% 0disputed0.0%
Critical 2 50.0% High 2 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 2 50.0% Queued for review 0 0.0% Not applicable 1 25.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 2 50.0% not blocked 2 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 1 25.0% Working exploit published 3 75.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / month
Unknown: 0None: 0Low: 0Medium: 0High: 2Critical: 2 Rejected: 0Out of RASP scope: 0Not applicable: 1Queued for review: 0Mitigated by environment configuration: 2No fix identified: 0No exploit published: 0Mitigation candidate: 1Rule in development: 0Protected by RASP: 0 unrecorded: 0not established: 0not blocked: 2blocked by ARMR today: 2 No public exploit: 0Forecast only: 0Proof of concept only: 0Working exploit published: 3Exploited in the wild: 1 November 2009: 1 CVE December 2009: 0 CVEs January 2010: 0 CVEs February 2010: 0 CVEs March 2010: 0 CVEs April 2010: 3 CVEs
Nov 09Dec 09Jan 10Feb 10Mar 10Apr 10
4 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2010-0842 High 2010-04-01 Mitigation candidate Working exploit published Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.
CVE-2010-0840 Critical 2010-04-01 Mitigated by environment configuration Exploited in the wild Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CVE-2010-0094 High 2010-04-01 Mitigated by environment configuration Working exploit published Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.
CVE-2009-3555 Critical 2009-11-09 Not applicable Working exploit published The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.