Vulnérabilités de la pile Logiciels applicatifs · Page n° 8

CVE-2024-21085

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can

• Mettez à jour vers 11.0.23+9-1ubuntu1~18.04.1
• Mettez à jour vers 11.0.23+9-1ubuntu1~20.04.2
• Mettez à jour vers 11.0.23+9-1ubuntu1~22.04.1
• Mettez à jour vers 11.0.23+9-1~deb11u1
• Mettez à jour vers 8u412-ga-1~18.04.1
• Mettez à jour vers 8u412-ga-1~20.04.1
• Mettez à jour vers 8u412-ga-1~22.04.1
• Mettez à jour vers 8u412-ga-1~24.04.2
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21068

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Ora

• Mettez à jour vers 11.0.23+9-1ubuntu1~18.04.1
• Mettez à jour vers 11.0.23+9-1ubuntu1~20.04.2
• Mettez à jour vers 17.0.11+9-1~18.04.1
• Mettez à jour vers 17.0.11+9-1~20.04.2
• Mettez à jour vers 17.0.11+9-1~22.04.1
• Mettez à jour vers 17.0.11+9-1~deb12u1
• Mettez à jour vers 21.0.3+9-1
• Mettez à jour vers 21.0.3+9-1ubuntu1~20.04.1
• Mettez à jour vers 8u412-ga-1~18.04.1
• Mettez à jour vers 8u412-ga-1~20.04.1
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21012

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Ora

• Mettez à jour vers 11.0.23+9-1ubuntu1~18.04.1
• Mettez à jour vers 11.0.23+9-1ubuntu1~20.04.2
• Mettez à jour vers 11.0.23+9-1ubuntu1~22.04.1
• Mettez à jour vers 17.0.11+9-1~18.04.1
• Mettez à jour vers 17.0.11+9-1~20.04.2
• Mettez à jour vers 17.0.11+9-1~22.04.1
• Mettez à jour vers 17.0.11+9-1~deb12u1
• Mettez à jour vers 21.0.3+9-1
• Mettez à jour vers 21.0.3+9-1ubuntu1~20.04.1
• Mettez à jour vers 21.0.3+9-1ubuntu1~22.04.1

CVE-2024-21011

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial de

• Mettez à jour vers 11.0.23+9-1ubuntu1~18.04.1
• Mettez à jour vers 11.0.23+9-1ubuntu1~20.04.2
• Mettez à jour vers 17.0.11+9-1~18.04.1
• Mettez à jour vers 17.0.11+9-1~20.04.2
• Mettez à jour vers 17.0.11+9-1~22.04.1
• Mettez à jour vers 17.0.11+9-1~deb12u1
• Mettez à jour vers 21.0.3+9-1
• Mettez à jour vers 21.0.3+9-1ubuntu1~20.04.1
• Mettez à jour vers 8u412-ga-1~18.04.1
• Mettez à jour vers 8u412-ga-1~20.04.1
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21005

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-21004

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete ac

CVE-2024-21003

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-21002

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete ac

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue a

• Mettez à jour vers 10.0.13
• Mettez à jour vers 10.1.9
• Mettez à jour vers 10.2.6
• Mettez à jour vers 10.3.5
• Mettez à jour vers 9.5.18

User with permissions to create a data source can CRUD all data sources

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

• Mettez à jour vers 10.0.12
• Mettez à jour vers 10.1.8
• Mettez à jour vers 10.2.5
• Mettez à jour vers 10.3.4
• Mettez à jour vers 9.5.7

CVE-2024-20945

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of

• Mettez à jour vers 11.0.22+7-0ubuntu2~18.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~20.04.1
• Mettez à jour vers 17.0.10+7-1~18.04.1
• Mettez à jour vers 17.0.10+7-1~20.04.1
• Mettez à jour vers 17.0.10+7-1~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1
• Mettez à jour vers 21.0.2+13-1
• Mettez à jour vers 21.0.2+13-1~20.04.1
• Mettez à jour vers 8u402-ga-2ubuntu1~18.04
• Mettez à jour vers 8u402-ga-2ubuntu1~20.04
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20925

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterpri

CVE-2024-20923

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition acces

CVE-2024-20921

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or compl

• Mettez à jour vers 11.0.22+7-0ubuntu2~18.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~20.04.1
• Mettez à jour vers 17.0.10+7-1~18.04.1
• Mettez à jour vers 17.0.10+7-1~20.04.1
• Mettez à jour vers 17.0.10+7-1~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1
• Mettez à jour vers 21.0.2+13-1
• Mettez à jour vers 21.0.2+13-1~20.04.1
• Mettez à jour vers 8u402-ga-2ubuntu1~18.04
• Mettez à jour vers 8u402-ga-2ubuntu1~20.04
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20919

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificati

• Mettez à jour vers 11.0.22+7-0ubuntu2~18.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~20.04.1
• Mettez à jour vers 17.0.10+7-1~18.04.1
• Mettez à jour vers 17.0.10+7-1~20.04.1
• Mettez à jour vers 17.0.10+7-1~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1
• Mettez à jour vers 21.0.2+13-1
• Mettez à jour vers 21.0.2+13-1~20.04.1
• Mettez à jour vers 8u402-ga-2ubuntu1~18.04
• Mettez à jour vers 8u402-ga-2ubuntu1~20.04
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2023-6152

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.

• Mettez à jour vers 10.0.11
• Mettez à jour vers 10.1.7
• Mettez à jour vers 10.2.4
• Mettez à jour vers 10.3.3
• Mettez à jour vers 9.5.16

Stored XSS in graph items select form

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

• Mettez à jour vers 1:6.0.24+dfsg-1
• Mettez à jour vers 5.0.40rc1
• Mettez à jour vers 6.0.24rc1
• Mettez à jour vers 6.4.9rc1
• Mettez à jour vers 7.0.0alpha8

CVE-2024-20952

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificat

• Mettez à jour vers 11.0.22+7-0ubuntu2~18.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~20.04.1
• Mettez à jour vers 17.0.10+7-1~18.04.1
• Mettez à jour vers 17.0.10+7-1~20.04.1
• Mettez à jour vers 17.0.10+7-1~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1
• Mettez à jour vers 21.0.2+13-1
• Mettez à jour vers 21.0.2+13-1~20.04.1
• Mettez à jour vers 8u402-ga-2ubuntu1~18.04
• Mettez à jour vers 8u402-ga-2ubuntu1~20.04
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-20932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Orac

• Mettez à jour vers 17.0.10+7-1~18.04.1
• Mettez à jour vers 17.0.10+7-1~20.04.1
• Mettez à jour vers 17.0.10+7-1~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1

CVE-2024-20926

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Orac

• Mettez à jour vers 11.0.22+7-0ubuntu2~18.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~20.04.1
• Mettez à jour vers 11.0.22+7-0ubuntu2~22.04.1
• Mettez à jour vers 17.0.10+7-1~deb12u1
• Mettez à jour vers 21.0.2+13-1
• Mettez à jour vers 8u402-ga-2ubuntu1~18.04
• Mettez à jour vers 8u402-ga-2ubuntu1~20.04
• Mettez à jour vers 8u402-ga-2ubuntu1~22.04
• Mettez à jour vers 8u432-ga~us1-0ubuntu2~16.04.4