Veille CVE

Janvier 2021

4 CVE

Critique 1 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2021-3156 7.8 Élevée Exploitée

    Sudo project sudo · Fedoraproject fedora · Debian debian linux · Netapp active iq unified manager

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

  2. CVE-2021-3199 9.8 Critique Exploitée

    Onlyoffice document server

    Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

  3. CVE-2020-6572 8.8 Élevée Exploitée

    Google Chrome

    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

  4. CVE-2020-17519 7.5 Élevée Exploitée

    Apache Software Foundation Apache Flink · apache flink

    A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.