p PatchFirst

PatchFirst · Latest vulnerabilities

Applications stack vulnerabilities · Page 10

Vulnerabilities published for Applications in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Applications

Vulnerabilities: 324

  1. CVE-2023-22041

    Medium · CVSS 5.1EPSS 0.48%Fix available

    CVE-2023-22041

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vu

    java openjdk-17 openjdk-9 openjdk-lts openjdk-17 openjdk-17 openjdk-lts openjdk-13 openjdk-16 openjdk-17 openjdk-18 openjdk-ltsOperating systems Applications
    • Update to 11.0.20+8-1ubuntu1~18.04
    • Update to 11.0.20+8-1ubuntu1~20.04
    • Update to 11.0.20+8-1ubuntu1~22.04
    • Update to 17.0.8+7-1~18.04
    • Update to 17.0.8+7-1~20.04.2
    • Update to 17.0.8+7-1~22.04
    • Update to 17.0.8+7-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-22036

    Low · CVSS 3.7EPSS 1.27%Fix available

    CVE-2023-22036

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partia

    java openjdk-17 openjdk-9 openjdk-lts openjdk-17 openjdk-17 openjdk-lts openjdk-13 openjdk-16 openjdk-17 openjdk-18 openjdk-ltsOperating systems Applications
    • Update to 11.0.20+8-1ubuntu1~18.04
    • Update to 11.0.20+8-1ubuntu1~20.04
    • Update to 11.0.20+8-1ubuntu1~22.04
    • Update to 17.0.8+7-1~18.04
    • Update to 17.0.8+7-1~20.04.2
    • Update to 17.0.8+7-1~22.04
    • Update to 17.0.8+7-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-22006

    Low · CVSS 3.1EPSS 0.95%Fix available

    CVE-2023-22006

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulner

    java openjdk-17 openjdk-9 openjdk-lts openjdk-17 openjdk-17 openjdk-lts openjdk-13 openjdk-16 openjdk-17 openjdk-18 openjdk-ltsOperating systems Applications
    • Update to 11.0.20+8-1ubuntu1~18.04
    • Update to 11.0.20+8-1ubuntu1~20.04
    • Update to 11.0.20+8-1ubuntu1~22.04
    • Update to 17.0.8+7-1~18.04
    • Update to 17.0.8+7-1~20.04.2
    • Update to 17.0.8+7-1~22.04
    • Update to 17.0.8+7-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2023-29457

    Medium · CVSS 6.3EPSS 0.57%Fix available

    Insufficient validation of Action form input fields

    Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.

    zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 4.0.46rc1
    • Update to 5.0.35rc1
    • Update to 6.0.18rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2023-29458

    Medium · CVSS 5.9EPSS 0.76%Fix available

    Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

    Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

    zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 5.0.35rc1
    • Update to 6.0.18rc1
    • Update to 6.4.3rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2023-29456

    Medium · CVSS 5.7EPSS 0.56%Fix available

    Inefficient URL schema validation

    URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.

    zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 4.0.47rc1
    • Update to 5.0.36rc1
    • Update to 6.0.19rc1
    • Update to 6.4.4rc1
    • Update to 7.0.0alpha2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2023-29455

    Medium · CVSS 5.4EPSS 0.6%Fix available

    Reflected XSS in several fields of graph form

    Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.

    zabbix zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 4.0.46rc1
    • Update to 5.0.35rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2023-29454

    Medium · CVSS 5.4EPSS 0.57%Fix available

    Persistent XSS in the user form

    Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.

    zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 4.0.46rc1
    • Update to 5.0.35rc1
    • Update to 6.0.18rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2023-29452

    Medium · CVSS 5.5EPSS 64.06%Fix available

    Remove possibility to add html into Geomap attribution field

    Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

    zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 6.0.18rc1
    • Update to 6.4.2rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2023-29450

    High · CVSS 8.5EPSS 1.26%Fix available

    Unauthorized limited filesystem access from preprocessing

    JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.

    zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 5.0.32rc1
    • Update to 6.0.14rc1 (6.0.16 is recommended)
    • Update to 6.2.8rc1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2023-29449

    Medium · CVSS 5.9EPSS 1.16%Fix available

    Limited control of resource utilization in JS preprocessing

    JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

    zabbix zabbix zabbix zabbix zabbixOperating systems Applications
    • Update to 1:6.0.23+dfsg-1
    • Update to 5.0.32rc1
    • Update to 6.0.14rc1 (6.0.16 is recommended)
    • Update to 6.2.8rc1
    • Update to 6.4.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2023-3128

    Critical · CVSS 9.4EPSS 4%Fix available

    CVE-2023-3128

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    grafana grafanaOperating systems Applications
    • Update to 8.5.27
    • Update to 9.2.20
    • Update to 9.3.16
    • Update to 9.4.13
    • Update to 9.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2023-2183

    Medium · CVSS 4.1EPSS 1.03%Fix available

    CVE-2023-2183

    Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

    grafana grafanaOperating systems Applications
    • Update to 8.5.26
    • Update to 9.2.19
    • Update to 9.3.15
    • Update to 9.4.12
    • Update to 9.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2023-2801

    High · CVSS 7.5EPSS 0.74%Fix available

    CVE-2023-2801

    Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

    grafana grafanaOperating systems Applications
    • Update to 9.4.12
    • Update to 9.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2023-1387

    Medium · CVSS 4.2EPSS 1.5%Fix available

    CVE-2023-1387

    Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.

    grafana grafanaOperating systems Applications
    • Update to 9.2.17
    • Update to 9.3.13
    • Update to 9.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2023-21968

    Low · CVSS 3.7EPSS 1.04%Fix available

    CVE-2023-21968

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vu

    java openjdk-17 openjdk-8 openjdk-9 openjdk-17 openjdk-8 openjdk-lts openjdk-17 openjdk-8 openjdk-lts openjdk-13 openjdk-16Operating systems Applications
    • Update to 11.0.19+7~us1-0ubuntu1~18.04.1
    • Update to 11.0.19+7~us1-0ubuntu1~20.04.1
    • Update to 17.0.7+7-1~deb12u1
    • Update to 17.0.7+7~us1-0ubuntu1~18.04
    • Update to 17.0.7+7~us1-0ubuntu1~20.04
    • Update to 17.0.7+7~us1-0ubuntu1~22.04.2
    • Update to 8u372-ga~us1-0ubuntu1~16.04
    • Update to 8u372-ga~us1-0ubuntu1~18.04
    • Update to 8u372-ga~us1-0ubuntu1~20.04
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2023-21967

    Medium · CVSS 5.9EPSS 1.54%Fix available

    CVE-2023-21967

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnera

    java openjdk-17 openjdk-8 openjdk-9 openjdk-17 openjdk-8 openjdk-lts openjdk-17 openjdk-8 openjdk-lts openjdk-13 openjdk-16Operating systems Applications
    • Update to 11.0.19+7~us1-0ubuntu1~18.04.1
    • Update to 11.0.19+7~us1-0ubuntu1~20.04.1
    • Update to 17.0.7+7-1~deb12u1
    • Update to 17.0.7+7~us1-0ubuntu1~18.04
    • Update to 17.0.7+7~us1-0ubuntu1~20.04
    • Update to 17.0.7+7~us1-0ubuntu1~22.04.2
    • Update to 8u372-ga~us1-0ubuntu1~16.04
    • Update to 8u372-ga~us1-0ubuntu1~18.04
    • Update to 8u372-ga~us1-0ubuntu1~20.04
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2023-21954

    Medium · CVSS 5.9EPSS 1.43%Fix available

    CVE-2023-21954

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This v

    java openjdk-17 openjdk-8 openjdk-9 openjdk-17 openjdk-8 openjdk-lts openjdk-17 openjdk-8 openjdk-lts openjdk-13 openjdk-16Operating systems Applications
    • Update to 11.0.19+7~us1-0ubuntu1~18.04.1
    • Update to 11.0.19+7~us1-0ubuntu1~20.04.1
    • Update to 17.0.7+7-1~deb12u1
    • Update to 17.0.7+7~us1-0ubuntu1~18.04
    • Update to 17.0.7+7~us1-0ubuntu1~20.04
    • Update to 17.0.7+7~us1-0ubuntu1~22.04.2
    • Update to 8u372-ga~us1-0ubuntu1~16.04
    • Update to 8u372-ga~us1-0ubuntu1~18.04
    • Update to 8u372-ga~us1-0ubuntu1~20.04
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2023-21939

    Medium · CVSS 5.3EPSS 2.5%Fix available

    CVE-2023-21939

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies

    java openjdk-17 openjdk-8 openjdk-9 openjdk-17 openjdk-8 openjdk-lts openjdk-17 openjdk-8 openjdk-lts openjdk-13 openjdk-16Operating systems Applications
    • Update to 11.0.19+7~us1-0ubuntu1~18.04.1
    • Update to 11.0.19+7~us1-0ubuntu1~20.04.1
    • Update to 17.0.7+7-1~deb12u1
    • Update to 17.0.7+7~us1-0ubuntu1~18.04
    • Update to 17.0.7+7~us1-0ubuntu1~20.04
    • Update to 17.0.7+7~us1-0ubuntu1~22.04.2
    • Update to 8u372-ga~us1-0ubuntu1~16.04
    • Update to 8u372-ga~us1-0ubuntu1~18.04
    • Update to 8u372-ga~us1-0ubuntu1~20.04
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →