CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-5997
https://notcve.org/view.php?id=CVE-2023-5997
Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Use after free en Garbage Collection en Google Chrome anterior a 119.0.6045.159 permitía a un atacante remoto explotar potencialmente la corrupción del heap a través de una página HTML manipulada. (Severidad de seguridad de Chrome: alta) • https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html https://crbug.com/1497997 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JHUI5HW7QXT3U74MJMTLUMF5REDO5HD5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MN3JQGEC4EFQP3WTI33YBD3CLC3I7P4X https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWHRLW3GDNFBFSBHDD4QOPUPX7ORTUEC https://security.gentoo.org/glsa/202311-11 https://secu • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-5528 – Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-5528
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si utilizan un complemento de almacenamiento en árbol para nodos de Windows. A flaw was found in Kubernetes, where a user who can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. • https://github.com/kubernetes/kubernetes/issues/121879 https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4 https://security.netapp.com/advisory/ntap-20240119 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-46850
https://notcve.org/view.php?id=CVE-2023-46850
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. Use after free en OpenVPN versión 2.6.0 a 2.6.6 puede provocar un comportamiento indefinido, pérdida de búferes de memoria o ejecución remota al enviar búferes de red a un par remoto. • https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4 https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850 https://www.debian.org/security/2023/dsa-5555 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-46849
https://notcve.org/view.php?id=CVE-2023-46849
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. El uso de la opción --fragment en ciertas configuraciones de OpenVPN versión 2.6.0 a 2.6.6 permite a un atacante desencadenar un comportamiento de división por cero que podría provocar un bloqueo de la aplicación y provocar una denegación de servicio. • https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4 https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850 https://www.debian.org/security/2023/dsa-5555 • CWE-369: Divide By Zero •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2023-5547 – Moodle: xss risk when previewing data in course upload tool
https://notcve.org/view.php?id=CVE-2023-5547
The course upload preview contained an XSS risk for users uploading unsafe data. La vista previa de la carga del curso contenía un riesgo XSS para los usuarios que cargaban datos no seguros. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79455 https://bugzilla.redhat.com/show_bug.cgi?id=2243447 https://moodle.org/mod/forum/discuss.php?d=451588 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •