Ubuntu Security Notice 6315-1 - Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information.

==========================================================================  
Ubuntu Security Notice USN-6315-1  
August 29, 2023

linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gke, linux-gkeop,  
linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency,  
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15  
vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:  
- linux: Linux kernel  
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems  
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems  
- linux-gke: Linux kernel for Google Container Engine (GKE) systems  
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems  
- linux-ibm: Linux kernel for IBM cloud systems  
- linux-kvm: Linux kernel for cloud environments  
- linux-lowlatency: Linux low latency kernel  
- linux-nvidia: Linux kernel for NVIDIA systems  
- linux-oracle: Linux kernel for Oracle Cloud systems  
- linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems  
- linux-hwe-5.15: Linux hardware enablement (HWE) kernel  
- linux-lowlatency-hwe-5.15: Linux low latency kernel  
- linux-oracle-5.15: Linux kernel for Oracle Cloud systems

Details:

Daniel Moghimi discovered that some Intel(R) Processors did not properly  
clear microarchitectural state after speculative execution of various  
instructions. A local unprivileged user could use this to obtain to  
sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle  
speculative execution of certain vector register instructions. A local  
attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux  
kernel did not properly handle locking for rings with IOPOLL, leading to a  
double-free vulnerability. A local attacker could use this to cause a  
denial of service (system crash) or possibly execute arbitrary code.  
(CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier  
implementation in the Linux kernel did not properly perform reference  
counting in some situations, leading to a use-after-free vulnerability. A  
local attacker could use this to cause a denial of service (system crash)  
or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not  
properly handle certain error conditions, leading to a use-after-free  
vulnerability. A local attacker could use this to cause a denial of service  
(system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler  
implementation in the Linux kernel contained an out-of-bounds write  
vulnerability. A local attacker could use this to cause a denial of service  
(system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with  
netfilter/firewall marks implementation in the Linux kernel did not  
properly handle reference counting, leading to a use-after-free  
vulnerability. A local attacker could use this to cause a denial of service  
(system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did  
not properly handle table rules flush in certain circumstances. A local  
attacker could possibly use this to cause a denial of service (system  
crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did  
not properly handle rule additions to bound chains in certain  
circumstances. A local attacker could possibly use this to cause a denial  
of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not  
properly handle PIPAPO element removal, leading to a use-after-free  
vulnerability. A local attacker could possibly use this to cause a denial  
of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did  
not properly handle bound chain deactivation in certain circumstances. A  
local attacker could possibly use this to cause a denial of service (system  
crash) or execute arbitrary code. (CVE-2023-4015)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 22.04 LTS:  
   linux-image-5.15.0-1026-gkeop   5.15.0-1026.31  
   linux-image-5.15.0-1031-nvidia  5.15.0-1031.31  
   linux-image-5.15.0-1031-nvidia-lowlatency  5.15.0-1031.31  
   linux-image-5.15.0-1036-ibm     5.15.0-1036.39  
   linux-image-5.15.0-1040-gcp     5.15.0-1040.48  
   linux-image-5.15.0-1040-gke     5.15.0-1040.45  
   linux-image-5.15.0-1040-kvm     5.15.0-1040.45  
   linux-image-5.15.0-1041-oracle  5.15.0-1041.47  
   linux-image-5.15.0-1043-aws     5.15.0-1043.48  
   linux-image-5.15.0-82-generic   5.15.0-82.91  
   linux-image-5.15.0-82-generic-64k  5.15.0-82.91  
   linux-image-5.15.0-82-generic-lpae  5.15.0-82.91  
   linux-image-5.15.0-82-lowlatency  5.15.0-82.91  
   linux-image-5.15.0-82-lowlatency-64k  5.15.0-82.91  
   linux-image-aws-lts-22.04       5.15.0.1043.42  
   linux-image-gcp-lts-22.04       5.15.0.1040.36  
   linux-image-generic             5.15.0.82.78  
   linux-image-generic-64k         5.15.0.82.78  
   linux-image-generic-lpae        5.15.0.82.78  
   linux-image-gke                 5.15.0.1040.39  
   linux-image-gke-5.15            5.15.0.1040.39  
   linux-image-gkeop               5.15.0.1026.25  
   linux-image-gkeop-5.15          5.15.0.1026.25  
   linux-image-ibm                 5.15.0.1036.32  
   linux-image-kvm                 5.15.0.1040.36  
   linux-image-lowlatency          5.15.0.82.84  
   linux-image-lowlatency-64k      5.15.0.82.84  
   linux-image-nvidia              5.15.0.1031.31  
   linux-image-nvidia-lowlatency   5.15.0.1031.31  
   linux-image-oracle-lts-22.04    5.15.0.1041.36  
   linux-image-virtual             5.15.0.82.78

Ubuntu 20.04 LTS:  
   linux-image-5.15.0-1041-oracle  5.15.0-1041.47~20.04.1  
   linux-image-5.15.0-1043-aws     5.15.0-1043.48~20.04.1  
   linux-image-5.15.0-82-generic   5.15.0-82.91~20.04.1  
   linux-image-5.15.0-82-generic-64k  5.15.0-82.91~20.04.1  
   linux-image-5.15.0-82-generic-lpae  5.15.0-82.91~20.04.1  
   linux-image-5.15.0-82-lowlatency  5.15.0-82.91~20.04.1  
   linux-image-5.15.0-82-lowlatency-64k  5.15.0-82.91~20.04.1  
   linux-image-aws                 5.15.0.1043.48~20.04.31  
   linux-image-generic-64k-hwe-20.04  5.15.0.82.91~20.04.40  
   linux-image-generic-hwe-20.04   5.15.0.82.91~20.04.40  
   linux-image-generic-lpae-hwe-20.04  5.15.0.82.91~20.04.40  
   linux-image-lowlatency-64k-hwe-20.04  5.15.0.82.91~20.04.37  
   linux-image-lowlatency-hwe-20.04  5.15.0.82.91~20.04.37  
   linux-image-oem-20.04           5.15.0.82.91~20.04.40  
   linux-image-oem-20.04b          5.15.0.82.91~20.04.40  
   linux-image-oem-20.04c          5.15.0.82.91~20.04.40  
   linux-image-oem-20.04d          5.15.0.82.91~20.04.40  
   linux-image-oracle              5.15.0.1041.47~20.04.1  
   linux-image-virtual-hwe-20.04   5.15.0.82.91~20.04.40

After a standard system update you need to reboot your computer to make  
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have  
been given a new version number, which requires you to recompile and  
reinstall all third party kernel modules you might have installed.  
Unless you manually uninstalled the standard kernel metapackages  
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,  
linux-powerpc), a standard system upgrade will automatically perform  
this as well.

References:  
   https://ubuntu.com/security/notices/USN-6315-1  
   CVE-2022-40982, CVE-2023-20593, CVE-2023-21400, CVE-2023-3609,  
   CVE-2023-3610, CVE-2023-3611, CVE-2023-3776, CVE-2023-3777,  
   CVE-2023-3995, CVE-2023-4004, CVE-2023-4015

Package Information:  
   https://launchpad.net/ubuntu/+source/linux/5.15.0-82.91  
   https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1043.48  
   https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1040.48  
   https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1040.45  
   https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1026.31  
   https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1036.39  
   https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1040.45  
   https://launchpad.net/ubuntu/+source/linux-lowlatency/5.15.0-82.91  
   https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1031.31  
   https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1041.47  
   https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1043.48~20.04.1  
   https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-82.91~20.04.1

 https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-82.91~20.04.1

 https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1041.47~20.04.1

Ubuntu Security Notice USN-6315-1

IQ-Medya CMS version 2.0 suffers from a cross site scripting vulnerability.

**IQ-Medya CMS 2.0 Cross Site Scripting**

Posted Aug 30, 2023

Authored by indoushka

IQ-Medya CMS version 2.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | ab1e62fc2de79708c62ff8ba7205592a862ce474915df4ff25b9a691573bdc26

Download | Favorite | View

**IQ-Medya CMS 2.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : İQ-Medya CMS v2.0 XSS Vulnerability                                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://iq-medya.net.tr                                                                                            |  | # Dork      : intext:''Tasarım iQ Digital''                                                                                      |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : /tr/blog.php?page=<script>alert(/indoushka/);</script>[+]  http://127.0.0.1/uzmangayrimenkulcomtr/tr/blog.php?page=%3Cscript%3Ealert(/indoushka/);%3C/script%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (82,058)
*   Arbitrary (16,220)
*   BBS (2,859)
*   Bypass (1,741)
*   CGI (1,026)
*   Code Execution (7,285)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,348)
*   DoS (23,462)
*   Encryption (2,370)
*   Exploit (52,004)
*   File Inclusion (4,225)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,788)
*   Intrusion Detection (892)
*   Java (3,046)
*   JavaScript (859)
*   Kernel (6,696)
*   Local (14,466)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,149)
*   Proof of Concept (2,340)
*   Protocol (3,603)
*   Python (1,535)
*   Remote (30,817)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,891)
*   Shell (3,188)
*   Shellcode (1,215)
*   Sniffer (895)
*   Spoof (2,207)
*   SQL Injection (16,394)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (666)
*   Vulnerability (31,798)
*   Web (9,671)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,974)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,822)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (68)
*   Linux (46,555)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,781)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,852)
*   UNIX (9,302)
*   UnixWare (186)
*   Windows (6,579)
*   Other

IQ-Medya CMS 2.0 Cross Site Scripting

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.

**Solution**

 Fixed

Update the WordPress WP ERP plugin to the latest available version (at least 1.12.4).

Found this useful? Thank minhtuanact for reporting this vulnerability. Buy a coffee ☕

minhtuanact discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP ERP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.12.4.

**Other vulnerabilities in this plugin**

 0 present

 4 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34008: WordPress WP ERP plugin <= 1.12.3 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.

**Solution**

 Fixed

Update the WordPress WooCommerce Box Office plugin to the latest available version (at least 1.1.51).

Found this useful? Thank Rafie Muhammad (Patchstack) for reporting this vulnerability. Buy a coffee ☕

Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WooCommerce Box Office Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.1.51.

**Other vulnerabilities in this plugin**

 0 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34004: WordPress WooCommerce Box Office plugin <= 1.1.50 - Contributor+ Stored Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.

**Solution**

 No fix

No patched version is available. The WordPress plugins review team was notified on 2023 April 20.

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WordPress Social Login Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34172: WordPress WordPress Social Login plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

**Solution**

 No fix

No patched version is available. The WordPress plugins review team was notified on 2023 April 24.

Found this useful? Thank thiennv for reporting this vulnerability. Buy a coffee ☕

thiennv discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress bbPress Toolkit Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34032: WordPress bbPress Toolkit plugin <= 1.0.12 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <= 0.0.5 versions.

**Solution**

 No fix

No patched version is available. The WordPress plugins review team was notified on 2023 April 25.

Found this useful? Thank thiennv for reporting this vulnerability. Buy a coffee ☕

thiennv discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Dynamic QR Code Generator Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34022: WordPress Dynamic QR Code Generator plugin <= 0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions.

**Solution**

 No fix

No patched version is available. The WordPress plugins review team was notified on 2023 April 20.

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Yandex Metrica Counter Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34173: WordPress Yandex Metrica Counter plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.

**Solution**

 No fix

No patched version is available. The WordPress plugins review team was notified on 2023 April 25.

Nguyen Xuan Chien discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WordPress Social Login Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-34023: WordPress WordPress Social Login plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Call Now Icon Animate Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

Tag

#web