VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 16 hours ago
Reset
More filters (1)
Columns
Oracle product: Oracle Java SE / Java SE, JRockit, Java SE Embedded✕
Overview 17 matches · 12 in RASP scope · 9 protected · 0 KEV · 1 public PoC · 0 CISA SSVC · 2 EPSS ≥ 0.5 · 0 disputed
17matches 12in RASP scope70.6% 9protected52.9% 0KEV0.0% 1public PoC5.9% 0CISA SSVC0.0% 2EPSS ≥ 0.511.8% 0disputed0.0%
Critical 0 0.0% High 6 35.3% Medium 7 41.2% Low 4 23.5% None 0 0.0% Unknown 0 0.0%
Protected by RASP 9 52.9% Rule in development 0 0.0% Mitigation candidate 2 11.8% No exploit published 0 0.0% No fix identified 1 5.9% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 5 29.4% Rejected 0 0.0%
blocked by ARMR today 9 52.9% not blocked 8 47.1% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 5.9% Forecast only 1 5.9% No public exploit 15 88.2%
split by peak 7 / quarter
Unknown: 0None: 0Low: 4Medium: 7High: 6Critical: 0 Rejected: 0Out of RASP scope: 5Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 1No exploit published: 0Mitigation candidate: 2Rule in development: 0Protected by RASP: 9 unrecorded: 0not established: 0not blocked: 8blocked by ARMR today: 9 No public exploit: 15Forecast only: 1Proof of concept only: 1Working exploit published: 0Exploited in the wild: 0 Q3 2013: 1 CVE Q4 2013: 7 CVEs Q1 2014: 3 CVEs Q2 2014: 0 CVEs Q3 2014: 0 CVEs Q4 2014: 0 CVEs Q1 2015: 0 CVEs Q2 2015: 2 CVEs Q3 2015: 4 CVEs
Q3 13Q4 13Q1 14Q2 14Q3 14Q4 14Q1 15Q2 15Q3 15
17 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2015-4749 Medium 2015-07-16 Mitigation candidate No public exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
CVE-2015-4748 High 2015-07-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVE-2015-2625 Low 2015-07-16 Out of RASP scope No public exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.
CVE-2015-2601 Medium 2015-07-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.
CVE-2015-4000 Low 2015-05-21 Out of RASP scope Proof of concept only The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
CVE-2015-2808 Low 2015-04-01 Out of RASP scope Forecast only The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
CVE-2014-0423 Medium 2014-01-15 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
CVE-2014-0411 Medium 2014-01-15 Out of RASP scope No public exploit Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.
CVE-2013-5907 High 2014-01-15 No fix identified No public exploit Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is due to incorrect input validation in LookupProcessor.cpp in the ICU Layout Engine, which allows attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted font file.
CVE-2013-5830 High 2013-10-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVE-2013-5825 Medium 2013-10-16 Mitigation candidate No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP.
CVE-2013-5823 Medium 2013-10-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via unknown vectors related to Security.
CVE-2013-5803 Low 2013-10-16 Out of RASP scope No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JGSS.
CVE-2013-5802 High 2013-10-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.
CVE-2013-5782 High 2013-10-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2013-5780 Medium 2013-10-16 Protected by RASP No public exploit Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
CVE-2013-4002 High 2013-07-23 Protected by RASP No public exploit XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.