CVE-2004-1029

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

• CWE-264

• http://jouko.iki.fi/adv/javaplugin.html
• http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
• http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
• http://secunia.com/advisories/13271Vendor Advisory
• http://secunia.com/advisories/29035Vendor Advisory
• http://securityreason.com/securityalert/61
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg21257249
• http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
• http://www.kb.cert.org/vuls/id/760344US Government Resource
• http://www.securityfocus.com/bid/12317Patch
• http://www.vupen.com/english/advisories/2008/0599Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674
• http://jouko.iki.fi/adv/javaplugin.html
• http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
• http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
• http://secunia.com/advisories/13271Vendor Advisory
• http://secunia.com/advisories/29035Vendor Advisory
• http://securityreason.com/securityalert/61
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg21257249
• http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
• http://www.kb.cert.org/vuls/id/760344US Government Resource
• http://www.securityfocus.com/bid/12317Patch
• http://www.vupen.com/english/advisories/2008/0599Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674

Published

Mar 1, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-1022Kerio Winroute Firewall before 6.0.7, ServerFirewall before …
• CVE-2004-1023Kerio Winroute Firewall before 6.0.9, ServerFirewall before …
• CVE-2004-1025Multiple heap-based buffer overflows in imlib 1.9.14 and ear…
• CVE-2004-1026Multiple integer overflows in the image handler for imlib 1.…
• CVE-2004-1027Directory traversal vulnerability in the -x (extract) comman…
• CVE-2004-1028Untrusted execution path vulnerability in chcod on AIX IBM 5…
• CVE-2004-1030fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier vers…
• CVE-2004-1031fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier vers…
• CVE-2004-1032fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier vers…
• CVE-2004-1033Fcron 2.0.1, 2.9.4, and possibly earlier versions leak file …
• CVE-2004-1034Buffer overflow in the http_open function in Kaffeine before…
• CVE-2004-1035Multiple integer signedness errors in (1) imapcommon.c, (2) …