WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: OpenJDK✕
Overview 114 matches · 85 in Waratek scope · 49 protected · 2 exploited · 1 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
114matches 85in Waratek scope74.6% 49protected43.0% 2exploited1.8% 1CISA KEV0.9% 3public PoC2.6% 2EPSS ≥ 0.51.8%
Protected by Waratek 49 43.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 36 31.6% Outside Waratek scope 26 22.8% Not applicable 3 2.6% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 30 26.3% Medium 55 48.2% Low 29 25.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 49 43.0% partly blocked 0 0.0% not blocked 65 57.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.8% Working exploit published 0 0.0% Proof of concept only 5 4.4% Forecast only 0 0.0% No public exploit 107 93.9%
split by peak 36 / year
Not applicable: 3Outside Waratek scope: 26No exploit published: 36Protected by Waratek: 49 Low: 29Medium: 55High: 30 not blocked: 65blocked by ARMR today: 49 No public exploit: 107Proof of concept only: 5Exploited: 2
200917 Protected by Waratek1 No exploit published11 Outside Waratek scope5 High10 Medium7 blocked by ARMR today1 not blocked16 No public exploit17 20100 20110 20122 No exploit published2 Medium2 not blocked2 No public exploit2 20133 Protected by Waratek1 Outside Waratek scope2 High1 Low2 blocked by ARMR today1 not blocked2 Exploited2 No public exploit1 20144 No exploit published3 Outside Waratek scope1 High3 Medium1 not blocked4 No public exploit4 20151 No exploit published1 High1 not blocked1 No public exploit1 20160 20170 20180 20191 Not applicable1 Medium1 not blocked1 No public exploit1 202036 Protected by Waratek23 No exploit published4 Outside Waratek scope9 High6 Medium10 Low20 blocked by ARMR today23 not blocked13 No public exploit36 202122 Protected by Waratek9 No exploit published4 Outside Waratek scope7 Not applicable2 High5 Medium14 Low3 blocked by ARMR today9 not blocked13 Proof of concept only2 No public exploit20 202220 Protected by Waratek10 No exploit published8 Outside Waratek scope2 High2 Medium17 Low1 blocked by ARMR today10 not blocked10 Proof of concept only2 No public exploit18 20237 Protected by Waratek5 No exploit published2 High1 Medium3 Low3 blocked by ARMR today5 not blocked2 Proof of concept only1 No public exploit6 20241 No exploit published1 High1 not blocked1 No public exploit1
20102012201420162018202020222024
114 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2009-3881 High 2009-11-09 No exploit published No public exploit Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.
CVE-2009-3880 Medium 2009-11-09 No exploit published No public exploit The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
CVE-2009-3879 High 2009-11-09 Outside Waratek scope No public exploit Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the getConfigurations function, aka Bug Id 6822057.
CVE-2009-3728 Medium 2009-11-09 Protected by Waratek No public exploit Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.
CVE-2009-2690 Medium 2009-08-10 No exploit published No public exploit The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.
CVE-2009-2689 High 2009-08-10 No exploit published No public exploit JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.
CVE-2009-2476 High 2009-08-10 No exploit published No public exploit The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.
CVE-2009-2475 High 2009-08-10 No exploit published No public exploit Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
CVE-2009-1896 High 2009-08-10 No exploit published No public exploit The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
CVE-2009-0794 Medium 2009-04-13 No exploit published No public exploit Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.
CVE-2009-0793 Medium 2009-04-09 Outside Waratek scope No public exploit cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
CVE-2009-0733 High 2009-03-23 Outside Waratek scope No public exploit Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.
CVE-2009-0723 High 2009-03-23 Outside Waratek scope No public exploit Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
CVE-2009-0581 Medium 2009-03-23 Outside Waratek scope No public exploit Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
‹ prev page 2 of 2 next ›