CVE-2019-10181
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2019-10181
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对数据真实性的验证不充分
Source: NVD (National Vulnerability Database)
Vulnerability Title
icedtea-web 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
icedtea-web是一款JSR-56（Java网络启动协议和API）的开源实现。 icedtea-web 1.7.2及之前版本和1.8.2及之前版本中存在数据伪造问题漏洞。该漏洞源于网络系统或产品未充分验证数据的来源或真实性。攻击者可利用伪造的数据进行攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IcedTea | icedtea-web | affects up to and including 1.7.2 and 1.8.2 | - |
II. Public POCs for CVE-2019-10181
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-10181
请登录查看更多情报信息。
- https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344x_refsource_CONFIRM
- https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327x_refsource_CONFIRM
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.htmlvendor-advisoryx_refsource_SUSE
- https://nvd.nist.gov/vuln/detail/CVE-2019-10181
Same Patch Batch · IcedTea · 2019-07-31 · 3 CVEs total
| CVE-2019-10182 | icedtea-web 代码注入漏洞 | |
| CVE-2019-10185 | icedtea-web 路径遍历漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-345
- CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX - CVE-2026-41432
New API: Stripe Webhook Signature Bypass via Empty Secret En - CVE-2026-42206
Roadiz OpenID Connect nonce generated but never validated — - CVE-2026-31835
Vaultwarden WebAuthn credential metadata tampered before sig - CVE-2026-43534
OpenClaw < 2026.4.10 - Unsanitized External Input in Agent H
V. Comments for CVE-2019-10181
No comments yet