OpenJDK: incorrect class loader permission check in ClassLoader getParent() (Libraries, 8055314)

An improper permission check issue was discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...

OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264)

A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions...

ICU: font parsing OOB read (OpenJDK 2D, 8055489)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309)

An improper permission check issue was discovered in the RMI component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions...

Multiple Cisco Products Cross-Site Scripting Vulnerabilities

Cisco AnyConnect Secure Mobility Client is a mobile client VPN tool.Cisco HostScan Engine is a host scanning engine. Cisco AnyConnect Secure Mobility Client and Cisco Host Scan fail to properly validate URLs used to construct applet paths in the DOM, allowing attackers to conduct cross-site...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco AnyConnect Secure Mobility Client 3.1.02043 and earlier and Cisco HostScan Engine 3.1.05183 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149...

PT-2015-3986

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.1.02043 and earlier Cisco HostScan Engine version 3.1.05183 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2014-8021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco AnyConnect Secure Mobility Client 3.1.02043 and earlier and Cisco HostScan Engine 3.1.05183 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving an applet-path URL, aka Bug IDs CSCup82990 and CSCuq80149...

OpenJDK: directory information leak via file chooser (Swing, 8055304)

An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

OpenJDK: directory information leak via file chooser (Swing, 8055304)

An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

ICU: font parsing OOB read (OpenJDK 2D, 8055489)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

ICU: font parsing OOB read (OpenJDK 2D, 8055489)

A boundary check flaw was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory...

OpenJDK: directory information leak via file chooser (Swing, 8055304)

An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

OpenJDK: code generation issue (Hotspot, 8064524)

A flaw was found in the way the Hotspot component in OpenJDK in the way this component generated code for bytecode. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions...

OpenJDK: directory information leak via file chooser (Swing, 8055304)

An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

PT-2014-9150

Name of the Vulnerable Software and Affected Versions plasma-applet-nm affected versions not specified Description The issue concerns a lack of server certificate verification in plasma-nm when using OpenVPN, allowing anyone with the preshared key to perform a man-in-the-middle MITM attack by...

icedtea-web: insecure temporary file use flaw in LiveConnect implementation

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp...