CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 1CVE-2023-5546 – Moodle: stored xss in quiz grading report via user id number
https://notcve.org/view.php?id=CVE-2023-5546
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Los números de identificación que se muestran en el informe de calificación del cuestionario requirieron una sanitización adicional para evitar un riesgo de XSS almacenado. • https://github.com/obelia01/CVE-2023-5546 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78971 https://bugzilla.redhat.com/show_bug.cgi?id=2243445 https://moodle.org/mod/forum/discuss.php?d=451587 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-5544 – Moodle: stored xss and potential idor risk in wiki comments
https://notcve.org/view.php?id=CVE-2023-5544
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. Los comentarios de Wiki requirieron restricciones de acceso y sanitización adicionales para evitar un riesgo XSS almacenado y un riesgo potencial de IDOR. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79509 https://bugzilla.redhat.com/show_bug.cgi?id=2243443 https://moodle.org/mod/forum/discuss.php?d=451585 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2023-39198 – Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()
https://notcve.org/view.php?id=CVE-2023-39198
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation. Se encontró una condición de ejecución en el controlador QXL del kernel de Linux. La función qxl_mode_dumb_create() desreferencia el qobj devuelto por qxl_gem_object_create_with_handle(), pero el identificador es el único que contiene una referencia a él. • https://access.redhat.com/errata/RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:3138 https://access.redhat.com/security/cve/CVE-2023-39198 https://bugzilla.redhat.com/show_bug.cgi?id=2218332 https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4956 – Quay: clickjacking on config-editor page severity
https://notcve.org/view.php?id=CVE-2023-4956
A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance. Se encontró una falla en Quay. • https://access.redhat.com/security/cve/CVE-2023-4956 https://bugzilla.redhat.com/show_bug.cgi?id=2238886 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-40661 – Opensc: multiple memory issues with pkcs15-init (enrollment tool)
https://notcve.org/view.php?id=CVE-2023-40661
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment. Se identificaron varias vulnerabilidades de memoria dentro de los paquetes OpenSC, particularmente en el proceso de inscripción de tarjetas usando pkcs15-init cuando un usuario o administrador registra tarjetas. Para aprovechar estas fallas, un atacante debe tener acceso físico al sistema informático y emplear un dispositivo USB o una tarjeta inteligente hechos a medida para manipular las respuestas a las APDU. • http://www.openwall.com/lists/oss-security/2023/12/13/3 https://access.redhat.com/errata/RHSA-2023:7876 https://access.redhat.com/errata/RHSA-2023:7879 https://access.redhat.com/security/cve/CVE-2023-40661 https://bugzilla.redhat.com/show_bug.cgi?id=2240913 https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651 https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1 https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories https://lists.debian.org&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •