Applications stack vulnerabilities · Page 15

CVE-2021-2388

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deploy

• Update to 11.0.12+7-1
• Update to 11.0.13+8-0ubuntu1~18.04
• Update to 11.0.13+8-0ubuntu1~20.04
• Update to 8u312-b07-0ubuntu1~16.04
• Update to 8u312-b07-0ubuntu1~18.04
• Update to 8u312-b07-0ubuntu1~20.04

CVE-2021-2341

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible

• Update to 11.0.12+7-1
• Update to 11.0.13+8-0ubuntu1~18.04
• Update to 11.0.13+8-0ubuntu1~20.04
• Update to 8u312-b07-0ubuntu1~16.04
• Update to 8u312-b07-0ubuntu1~18.04
• Update to 8u312-b07-0ubuntu1~20.04

CVE-2021-2369

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition

• Update to 11.0.12+7-1
• Update to 11.0.13+8-0ubuntu1~18.04
• Update to 11.0.13+8-0ubuntu1~20.04
• Update to 8u312-b07-0ubuntu1~16.04
• Update to 8u312-b07-0ubuntu1~18.04
• Update to 8u312-b07-0ubuntu1~20.04

CVE-2021-2163

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, de

• Update to 11.0.11+9-0ubuntu2~18.04
• Update to 11.0.11+9-0ubuntu2~20.04
• Update to 17~19-1
• Update to 8u292-b10-0ubuntu1~16.04.1
• Update to 8u292-b10-0ubuntu1~18.04
• Update to 8u292-b10-0ubuntu1~20.04

CVE-2021-2161

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Ora

CVE-2020-14803

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14798

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typica

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14797

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and san

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14796

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients r

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14792

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Jav

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14782

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and san

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14781

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets.

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2020-14779

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications

• Update to 11.0.9+11-0ubuntu1~18.04.1
• Update to 11.0.9+11-0ubuntu1~20.04
• Update to 11.0.9+11-1
• Update to 8u272-b10-0ubuntu1~16.04
• Update to 8u272-b10-0ubuntu1~18.04
• Update to 8u272-b10-0ubuntu1~20.04

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

CVE-2018-3762

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

CVE-2018-3761

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

CVE-2017-0936

Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.

CVE-2017-2824

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

• Update to 1:2.2.2+dfsg-1ubuntu1+esm1
• Update to 1:2.4.7+dfsg-2ubuntu2.1+esm1
• Update to 1:3.0.7+dfsg-3

CVE-2017-0895

Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.

CVE-2017-0894

Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.