CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 2CVE-2023-34152
https://notcve.org/view.php?id=CVE-2023-34152
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. • https://github.com/SudoIndividual/CVE-2023-34152 https://access.redhat.com/security/cve/CVE-2023-34152 https://bugzilla.redhat.com/show_bug.cgi?id=2210659 https://github.com/ImageMagick/ImageMagick/issues/6339 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-34153
https://notcve.org/view.php?id=CVE-2023-34153
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. • https://access.redhat.com/security/cve/CVE-2023-34153 https://bugzilla.redhat.com/show_bug.cgi?id=2210660 https://github.com/ImageMagick/ImageMagick/issues/6338 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2ZUHZXQ2C3JZYKPW4XHCMVVL467MA2V • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-2253 – distribution/distribution: DoS from malicious API request
https://notcve.org/view.php?id=CVE-2023-2253
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory. • https://bugzilla.redhat.com/show_bug.cgi?id=2189886 https://lists.debian.org/debian-lts-announce/2023/06/msg00035.html https://access.redhat.com/security/cve/CVE-2023-2253 • CWE-475: Undefined Behavior for Input to API CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-1664 – keycloak: Untrusted Certificate Validation
https://notcve.org/view.php?id=CVE-2023-1664
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. • https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0 https://access.redhat.com/security/cve/CVE-2023-1664 https://bugzilla.redhat.com/show_bug.cgi?id=2182196 • CWE-295: Improper Certificate Validation •
CVSS: 6.2EPSS: 0%CPEs: 6EXPL: 1CVE-2023-1981 – avahi: avahi-daemon can be crashed via DBus
https://notcve.org/view.php?id=CVE-2023-1981
A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. • https://access.redhat.com/security/cve/CVE-2023-1981 https://bugzilla.redhat.com/show_bug.cgi?id=2185911 https://github.com/lathiat/avahi/issues/375 • CWE-400: Uncontrolled Resource Consumption •