CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2023-2454 – postgresql: schema_element defeats protective search_path changes
https://notcve.org/view.php?id=CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code. • https://access.redhat.com/security/cve/CVE-2023-2454 https://security.netapp.com/advisory/ntap-20230706-0006 https://www.postgresql.org/support/security/CVE-2023-2454 https://bugzilla.redhat.com/show_bug.cgi?id=2207568 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2088 – openstack-cinder: silently access other user's volumes
https://notcve.org/view.php?id=CVE-2023-2088
A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality. • https://bugs.launchpad.net/bugs/2004555 https://security.openstack.org/ossa/OSSA-2023-003.html https://access.redhat.com/security/cve/CVE-2023-2088 https://bugzilla.redhat.com/show_bug.cgi?id=2179587 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-440: Expected Behavior Violation •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 1CVE-2023-1625 – Information leak in api
https://notcve.org/view.php?id=CVE-2023-1625
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system. Se descubrió una fuga de información en OpenStack Heat. Este problema podría permitir que un atacante remoto y autenticado utilice el comando 'stack show' para revelar parámetros que se supone deben permanecer ocultos. • https://access.redhat.com/security/cve/CVE-2023-1625 https://bugzilla.redhat.com/show_bug.cgi?id=2181621 https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb https://launchpad.net/bugs/1999665 • CWE-202: Exposure of Sensitive Information Through Data Queries •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-2203 – webkitgtk: Regression of CVE-2023-28205 fixes in the Red Hat Enterprise Linux
https://notcve.org/view.php?id=CVE-2023-2203
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2. • https://access.redhat.com/errata/RHSA-2023:2653 https://access.redhat.com/errata/RHSA-2023:3108 https://access.redhat.com/security/cve/CVE-2023-2203 https://bugzilla.redhat.com/show_bug.cgi?id=2188543 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32573 – qt: Uninitialized variable usage in m_unitsPerEm
https://notcve.org/view.php?id=CVE-2023-32573
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. A vulnerability was found in qt. The security flaw occurs due to uninitialized variable usage in m_unitsPerEm. • https://codereview.qt-project.org/c/qt/qtsvg/+/474093 https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX https://access.redhat.com/security/cve/CVE-2023-32573 https://bugzilla.redhat.com/show_bug.cgi?id=2208135 • CWE-369: Divide By Zero •