CVE-2004-1029
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and...
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
Exploit likelihood
What each source reports
NVD Score used
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
- Record
CVE-2004-1029- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
- Record
CVE-2004-1029- Updated
- 2026-11-02
EUVDEUVD-2004-1027 No score
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
- Record
EUVD-2004-1027- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx66-7j9p-32m3 No score
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and...
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
- Record
GHSA-fx66-7j9p-32m3- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass | 2004-11-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-1029 is a high vulnerability (CVSS 9.3) in Sun Jre, published November 24, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.0%, the 97th percentile. No source names a fixed version.
References
idefense.com/application/poi/display?id=158&type=vulnerabilities
jouko.iki.fi/adv/javaplugin.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674
lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
secunia.com/advisories/13271
Show 11 moreShow less
securityreason.com/securityalert/61
securityfocus.com/bid/12317
vupen.com/english/advisories/2008/0599
exchange.xforce.ibmcloud.com/vulnerabilities/18188
sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1
kb.cert.org/vuls/id/760344
www-1.ibm.com/support/docview.wss?uid=swg21257249
nvd.nist.gov/vuln/detail/CVE-2004-1029
github.com/advisories/GHSA-fx66-7j9p-32m3