CVE-2002-1292 in the critical feed json
The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Sta…
published 2002-11-14 23 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1276
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 22.4%
- EPSS 22.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The Microsoft Java virtual machine (VM) build 5.0.3805 and earlier, as used in Internet Explorer, allows remote attackers to extend the Standard Security Manager (SSM) class (com.ms.security.StandardSecurityManager) and bypass intended StandardSecurityManager restrictions by modifying the (1) deniedDefinitionPackages or (2) deniedAccessPackages settings, causing a denial of service by adding Java applets to the list of applets that are prevented from running.
Exploit prediction
22.45% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2002/ms02-069
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/10585
vdb-entry
-
securityfocus.com
/bid/6133
vdb-entry
-
marc.info
/?l=ntbugtraq&m=103684360031565&w=2
mailing-list
-
kb.cert.org
/vuls/id/237777
third-party-advisory, us-government-resource
-
marc.info
/?l=bugtraq&m=103682630823080&w=2
mailing-list
Sources
- CVE List CVE-2002-1292
- NVD CVE-2002-1292
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.