Cross site request forgery (csrf)

A flaw was found in Quay. Cross-site request forgery CSRF attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the...

CVE-2023-4956

A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerab...

CVE-2023-4959

CVE-2023-4959 affects Red Hat Quay where the config-editor page is vulnerable to cross-site request forgery (CSRF). Exploitation could coerce a victim’s browser to perform attacker-controlled actions on a Quay instance, including reconfiguring settings and adding admin users. Public sources consi...

CVE-2023-4959 Quay: cross-site request forgery (csrf) on config-editor page

A flaw was found in Quay. Cross-site request forgery CSRF attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the...

CVE-2023-4959 Quay: cross-site request forgery (csrf) on config-editor page

A flaw was found in Quay. Cross-site request forgery CSRF attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the...

CVE-2023-4959

A flaw was found in Quay. Cross-site request forgery CSRF attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the...

Red Hat Quay Security Vulnerability

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute and deploy containers. Red Hat Quay suffers from a security vulnerability that stems from the vulnerability of config-editor pages to clickjacking attacks. An attacker can exploit this...

PT-2023-31269 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A flaw was found in Quay, allowing cross-site request forgery CSRF attacks to force a user to perform unwanted actions in an application. The config-editor page, used to configure the Quay...

Red Hat Quay Cross-Site Request Forgery Vulnerability

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute, and deploy containers. Red Hat Quay suffers from a security vulnerability that stems from an existing vulnerability in the domain itself or in other domains through the use of techniques...

Moderate: Red Hat Bug Fix Advisory: Red Hat Quay v3.9.1 minor release

Red Hat Quay 3.9.1 is now available with bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Bug Fix Advisory: Red Hat Quay v3.8.11 bug fix release

Red Hat Quay 3.8.11 is now available with bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in th...

CVE-2023-3384

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

Cross site scripting

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384 Quay: stored cross site scripting

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384

Technical details about CVE-2023-3384 (affected product/version, root cause, impact, fix) are not provided in the connected documents; monitor for updates.

CVE-2023-3384 Quay: stored cross site scripting

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

Red Hat Quay 跨站脚本漏洞

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute and deploy containers. A security vulnerability exists in Red Hat Quay that stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to publish a...

CVE-2023-30520

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...