Java Se
Vendor:
First CVE: Aug 5, 2009 · Active for 16 years
21
Total CVEs
More Total CVEs than 94% of tracked products
21.0
Avg CVEs / Year
Higher CVE frequency than 98% of tracked products
8.3
Avg CVSS
Higher Avg CVSS than 74% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Java Se over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 5, 2009
16 years ago
Most Recent CVE
Nov 5, 2009
6,106 days ago
CVE Severity & Scoring
Java Se21 CVEs
29%
71%
All CVEs352,708 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown21 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown21 (100.0%)
User Interaction
None0 (0.0%)
Unknown21 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown21 (100.0%)
Top CVEs
Signals from CVEs in this product scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-3867HIGH Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3. | Nov 5, 2009 | 9.3 | 86 | NO | YES |
CVE-2009-3869HIGH Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JD | Nov 5, 2009 | 9.3 | 80 | NO | YES |
CVE-2009-2476HIGH The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attack | Aug 10, 2009 | 10.0 | 29 | NO | NO |
CVE-2009-3874HIGH Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE | Nov 5, 2009 | 9.3 | 28 | NO | NO |
CVE-2009-2722HIGH Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594. NOTE: this issue exists b | Aug 10, 2009 | 10.0 | 28 | NO | NO |
CVE-2009-2721HIGH Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003. | Aug 10, 2009 | 10.0 | 28 | NO | NO |
CVE-2009-2723HIGH Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262. | Aug 10, 2009 | 10.0 | 27 | NO | NO |
CVE-2009-2689HIGH JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows co | Aug 10, 2009 | 10.0 | 27 | NO | NO |
CVE-2009-3871HIGH Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, | Nov 5, 2009 | 9.3 | 25 | NO | NO |
CVE-2009-2724HIGH Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks." | Aug 10, 2009 | 9.3 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (21 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
2 CVEs
9.5% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
9.5% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (21 CVEs).
Media Mentions
Signals from CVEs in this product scope (21 CVEs).
Top CNAs Publishing CVEs For Java Se
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6 | 1 | 6.8 | 1.7% | 0 | 0 |