Приложения: уязвимости стека · Страница 8

CVE-2024-21085

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can

• Обновитесь до 11.0.23+9-1ubuntu1~18.04.1
• Обновитесь до 11.0.23+9-1ubuntu1~20.04.2
• Обновитесь до 11.0.23+9-1ubuntu1~22.04.1
• Обновитесь до 11.0.23+9-1~deb11u1
• Обновитесь до 8u412-ga-1~18.04.1
• Обновитесь до 8u412-ga-1~20.04.1
• Обновитесь до 8u412-ga-1~22.04.1
• Обновитесь до 8u412-ga-1~24.04.2
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21068

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Ora

• Обновитесь до 11.0.23+9-1ubuntu1~18.04.1
• Обновитесь до 11.0.23+9-1ubuntu1~20.04.2
• Обновитесь до 17.0.11+9-1~18.04.1
• Обновитесь до 17.0.11+9-1~20.04.2
• Обновитесь до 17.0.11+9-1~22.04.1
• Обновитесь до 17.0.11+9-1~deb12u1
• Обновитесь до 21.0.3+9-1
• Обновитесь до 21.0.3+9-1ubuntu1~20.04.1
• Обновитесь до 8u412-ga-1~18.04.1
• Обновитесь до 8u412-ga-1~20.04.1
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21012

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Ora

• Обновитесь до 11.0.23+9-1ubuntu1~18.04.1
• Обновитесь до 11.0.23+9-1ubuntu1~20.04.2
• Обновитесь до 11.0.23+9-1ubuntu1~22.04.1
• Обновитесь до 17.0.11+9-1~18.04.1
• Обновитесь до 17.0.11+9-1~20.04.2
• Обновитесь до 17.0.11+9-1~22.04.1
• Обновитесь до 17.0.11+9-1~deb12u1
• Обновитесь до 21.0.3+9-1
• Обновитесь до 21.0.3+9-1ubuntu1~20.04.1
• Обновитесь до 21.0.3+9-1ubuntu1~22.04.1

CVE-2024-21011

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial de

• Обновитесь до 11.0.23+9-1ubuntu1~18.04.1
• Обновитесь до 11.0.23+9-1ubuntu1~20.04.2
• Обновитесь до 17.0.11+9-1~18.04.1
• Обновитесь до 17.0.11+9-1~20.04.2
• Обновитесь до 17.0.11+9-1~22.04.1
• Обновитесь до 17.0.11+9-1~deb12u1
• Обновитесь до 21.0.3+9-1
• Обновитесь до 21.0.3+9-1ubuntu1~20.04.1
• Обновитесь до 8u412-ga-1~18.04.1
• Обновитесь до 8u412-ga-1~20.04.1
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21005

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-21004

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete ac

CVE-2024-21003

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-21002

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete ac

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue a

• Обновитесь до 10.0.13
• Обновитесь до 10.1.9
• Обновитесь до 10.2.6
• Обновитесь до 10.3.5
• Обновитесь до 9.5.18

User with permissions to create a data source can CRUD all data sources

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

• Обновитесь до 10.0.12
• Обновитесь до 10.1.8
• Обновитесь до 10.2.5
• Обновитесь до 10.3.4
• Обновитесь до 9.5.7

CVE-2024-20945

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of

• Обновитесь до 11.0.22+7-0ubuntu2~18.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~20.04.1
• Обновитесь до 17.0.10+7-1~18.04.1
• Обновитесь до 17.0.10+7-1~20.04.1
• Обновитесь до 17.0.10+7-1~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1
• Обновитесь до 21.0.2+13-1
• Обновитесь до 21.0.2+13-1~20.04.1
• Обновитесь до 8u402-ga-2ubuntu1~18.04
• Обновитесь до 8u402-ga-2ubuntu1~20.04
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20925

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-20923

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition acces

CVE-2024-20921

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or compl

• Обновитесь до 11.0.22+7-0ubuntu2~18.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~20.04.1
• Обновитесь до 17.0.10+7-1~18.04.1
• Обновитесь до 17.0.10+7-1~20.04.1
• Обновитесь до 17.0.10+7-1~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1
• Обновитесь до 21.0.2+13-1
• Обновитесь до 21.0.2+13-1~20.04.1
• Обновитесь до 8u402-ga-2ubuntu1~18.04
• Обновитесь до 8u402-ga-2ubuntu1~20.04
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20919

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificati

• Обновитесь до 11.0.22+7-0ubuntu2~18.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~20.04.1
• Обновитесь до 17.0.10+7-1~18.04.1
• Обновитесь до 17.0.10+7-1~20.04.1
• Обновитесь до 17.0.10+7-1~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1
• Обновитесь до 21.0.2+13-1
• Обновитесь до 21.0.2+13-1~20.04.1
• Обновитесь до 8u402-ga-2ubuntu1~18.04
• Обновитесь до 8u402-ga-2ubuntu1~20.04
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2023-6152

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.

• Обновитесь до 10.0.11
• Обновитесь до 10.1.7
• Обновитесь до 10.2.4
• Обновитесь до 10.3.3
• Обновитесь до 9.5.16

Stored XSS in graph items select form

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

• Обновитесь до 1:6.0.24+dfsg-1
• Обновитесь до 5.0.40rc1
• Обновитесь до 6.0.24rc1
• Обновитесь до 6.4.9rc1
• Обновитесь до 7.0.0alpha8

CVE-2024-20952

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificat

• Обновитесь до 11.0.22+7-0ubuntu2~18.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~20.04.1
• Обновитесь до 17.0.10+7-1~18.04.1
• Обновитесь до 17.0.10+7-1~20.04.1
• Обновитесь до 17.0.10+7-1~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1
• Обновитесь до 21.0.2+13-1
• Обновитесь до 21.0.2+13-1~20.04.1
• Обновитесь до 8u402-ga-2ubuntu1~18.04
• Обновитесь до 8u402-ga-2ubuntu1~20.04
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Orac

• Обновитесь до 17.0.10+7-1~18.04.1
• Обновитесь до 17.0.10+7-1~20.04.1
• Обновитесь до 17.0.10+7-1~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1

CVE-2024-20926

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Orac

• Обновитесь до 11.0.22+7-0ubuntu2~18.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~20.04.1
• Обновитесь до 11.0.22+7-0ubuntu2~22.04.1
• Обновитесь до 17.0.10+7-1~deb12u1
• Обновитесь до 21.0.2+13-1
• Обновитесь до 8u402-ga-2ubuntu1~18.04
• Обновитесь до 8u402-ga-2ubuntu1~20.04
• Обновитесь до 8u402-ga-2ubuntu1~22.04
• Обновитесь до 8u432-ga~us1-0ubuntu2~16.04.4