Login Request a demo
IC
Product
Icedtea-web
by Icedtea-web Project · last CVE Jul 7, 2022
4
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 3Medium 1Low 0
Severity
All severities4Critical0High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Icedtea-web to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-10185
8.6
4%
Jul 31
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file
Affected: through 1.7.2; 1.8.2
CVE-2019-10181
8.1
1%
Jul 31
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification
Affected: through 1.7.2; 1.8.2
CVE-2015-5236
7.5
1%
Jul 7
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks
Affected: All versions, or not specified
CVE-2019-10182
6.5
3%
Jul 31
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files
Affected: through 1.7.2; 1.8.2
Showing 4