Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: IcedTea Component: Icedtea-web Clear all filters
TI-2015-04397 CVE-2015-5236 · GHSA-f95f-r783-xxx3

Insufficient verification of data authenticity in Icedtea-web

Priority LOW 34

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2022-07-07 Will not fix CWE-345
TI-2019-07502 CVE-2019-10181 · GHSA-xv8g-hcfj-ppcw

Insufficient verification of data authenticity in icedtea-web

Priority LOW 38

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01165 Published 2019-07-31 Partial fix CWE-345
TI-2019-07503 CVE-2019-10182 · GHSA-cqfc-r7qj-5fgq

Path traversal in icedtea-web

Priority MEDIUM 41

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.

CVSS 3.0HIGH 8.2 Network No auth User interaction EPSS 0.02743 Published 2019-07-31 Partial fix CWE-22
TI-2019-07506 CVE-2019-10185 · GHSA-3q3x-68j9-f9vv

Path traversal in icedtea-web

Priority MEDIUM 44

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.04022 Published 2019-07-31 Partial fix CWE-22