Java exploitation: I think the most popular way to exploit systems with almost zero effort is with malicious Java applets. Used in conjunction with social engineering - almost every person instinctively clicks the 'Run applet' dialog. Even if you don't look at attacks involving SE, there are always exploits for the Java Browser Plugin freely available (IIRC, Oracle was phasing out the plugin. Don't remember the current status. Might be worth a look for you.)
tl;dr: Yes. All of these are possible attack vectors, either in combination with SE or through exploitation of unpatched systems or usin private exploits.
Just copied this over from your other Q.