VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2014-2410

9.3 High Out of RASP scope

Description

Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 12 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 4.4% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review automated inferred
  • Record active
Decided by oracle-component : The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the native WebLogic proxy plug-in. Oracle gives these no CPE of their own and names them only in the description.
Finding This CVE affects Oracle's JavaFX component, which Waratek RASP does not instrument. Oracle does not assign JavaFX its own CPE product, so this is detected from the CVE description rather than CPE data.

CVSS

9.3 v2.0 AV:N/AC:M/Au:N/C:C/I:C/A:C 1 metric

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 2.0 9.3 no band published AV:N/AC:M/Au:N/C:C/I:C/A:C NVD Primary published

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update April 2014 ↗ CPU 2014-Q2 Oracle Java SE / JavaFX (Java SE 8)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE JavaFX Java SE 8 8.0.0.0

🖥️ Product CPEs & Version Ranges

2 product(s) over 2 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle jdk javase 1.8.0
nvd oracle jre javase 1.8.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MULTIPLE, JAVAFX, NO AUTH REMOTE EXPLOIT, SEE NOTE 2 **Products:** JAVA SE, ORACLE JAVA SE, JDK

References

URLTags
http://security.gentoo.org/glsa/glsa-201502-12.xml Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html Vendor Advisory
http://www.securityfocus.com/bid/66886 Third Party Advisory, VDB Entry

Timeline

Published 2014-04-16 Last modified 2026-06-17
Published2014-04-16By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.