CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4910 – 3scale-admin-portal: logged out users tokens can be accessed
https://notcve.org/view.php?id=CVE-2023-4910
06 Nov 2023 — A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache. Se encontró una falla en 3Scale Admin Portal. Si un usuario cierra sesión en la página de tokens personales y luego presiona el botón atrás en el navegador, la página de tokens se representa desde la memoria caché del navegador. • https://access.redhat.com/security/cve/CVE-2023-4910 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.8EPSS: 94%CPEs: 444EXPL: 17CVE-2023-44487 – HTTP/2 Rapid Reset Attack Vulnerability
https://notcve.org/view.php?id=CVE-2023-44487
10 Oct 2023 — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023. A flaw was found in handling multiplexed streams in the HTTP/2 protocol. ... • https://github.com/imabee101/CVE-2023-44487 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1414
https://notcve.org/view.php?id=CVE-2022-1414
19 Oct 2022 — 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks. 3scale API Management versión 2 no lleva a cabo un saneo apropiado de las entradas del usuario en múltiples campos. Un usuario autenticado podría usar este fallo para inyectar scripts y posiblemente conseguir acceso a información confidencial o conducir otros ataques • https://access.redhat.com/security/cve/CVE-2022-1414 • CWE-20: Improper Input Validation CWE-1173: Improper Use of Validation Framework •
CVSS: 7.8EPSS: 0%CPEs: 79EXPL: 0CVE-2022-0330 – kernel: possible privileges escalation due to missing TLB flush
https://notcve.org/view.php?id=CVE-2022-0330
18 Feb 2022 — A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Se ha encontrado un fallo de acceso aleatorio a la memoria en la funcionalidad del controlador del kernel de la GPU i915 de Linux en la forma en que un usuario puede ejecutar código malicioso en la GPU. Este fallo permite a un usuario local bloquear el sistema o escal... • http://www.openwall.com/lists/oss-security/2022/11/30/1 • CWE-281: Improper Preservation of Permissions •
CVSS: 8.8EPSS: 0%CPEs: 76EXPL: 1CVE-2021-3656 – kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)
https://notcve.org/view.php?id=CVE-2021-3656
09 Sep 2021 — A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the en... • https://github.com/rami08448/CVE-2021-3656-Demo • CWE-862: Missing Authorization •
CVSS: 7.0EPSS: 0%CPEs: 68EXPL: 1CVE-2021-3609 – kernel: race condition in net/can/bcm.c leads to local privilege escalation
https://notcve.org/view.php?id=CVE-2021-3609
23 Jun 2021 — .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root. Se ha encontrado un fallo en el protocolo de red CAN BCM en el kernel de Linux, donde un atacante local puede abusar de un fallo en el subsistema CAN para corromper la memoria, bloquear el sistema o escalar privil... • https://bugzilla.redhat.com/show_bug.cgi?id=1971651 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14388
https://notcve.org/view.php?id=CVE-2020-14388
02 Jun 2021 — A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission. Se ha detectado un fallo en Red Hat 3scale API Management Platform, en el que los permisos de los miembros del portal de administración de una API no son aplicados apropiadamente. Este fallo permite a un usuario autenticado omitir la... • https://bugzilla.redhat.com/show_bug.cgi?id=1875553 • CWE-284: Improper Access Control •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3412
https://notcve.org/view.php?id=CVE-2021-3412
01 Jun 2021 — It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks. Se detectó que todas las versiones del portal de desarrollo de3Scale, carecen de protecciones contra la fuerza bruta. Un atacante podría usar esta brecha para omitir los controles de inicio de sesión y acceder a información privilegiada, o posiblemente conducir más ataques • https://bugzilla.redhat.com/show_bug.cgi?id=1928301 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25634
https://notcve.org/view.php?id=CVE-2020-25634
26 May 2021 — A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected. Se encontró un fallo en la URL de documentos de la API de Red Hat 3scale, donde puede acceder sin credenciales. Este fallo permite a un atacante visualizar información confidencial o modificar las API de servicio. • https://bugzilla.redhat.com/show_bug.cgi?id=1880201 • CWE-284: Improper Access Control CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14852
https://notcve.org/view.php?id=CVE-2019-14852
18 Mar 2021 — A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue. Se encontró un fallo en la puerta de enlace de APIcast de 3scale que habilitó el protocolo TLS versión 1.0. Un atacante podría apuntar al tráfico usando este protocolo más débil y romper su cifrado, consiguiend... • https://bugzilla.redhat.com/show_bug.cgi?id=1758208 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •