Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely convinces me that this is the case? What are some hard consequences or security exploits that exist for old versions of java?
There are a number of them, including those that allow arbitrary code execution.
From Qualys, on January 20 (last week as of this writing):
Java: 19 vulnerabilities addressed in Java 8 and Java 7, 13 are remotely exploitable with highest score CVSS 10. This should be high on your list for your patching efforts, at least on the desktop where most of the vulnerabilities are aimed at. Only four vulnerabilities also apply to servers.
CVSS 10 means:
they can be used to take control over the targeted machine, working remotely through a network and without requiring credentials
Precisely how these recently-patched vulnerabilities can be exploited, and their official names, isn't mentioned - assuming they have official names, as Qualys suggest they may include 0-day exploits. Oracle isn't giving many specifics.
Another, older vulnerability from 2013 also allows arbitrary code execution, via an Applet:
So, the big risk is complete control of the target machine.
For end users, arbitrary code execution on their machine may result from loading a malicious Applet.