Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
13f8514c by Moritz Muehlenhoff at 2018-06-29T22:58:09+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -1,13 +1,13 @@
CVE-2018-13025 (protected/apps/admin/controller/photoController.php in YXcms
1.4.7 ...)
- TODO: check
+ NOT-FOR-US: YXcms
CVE-2018-13024 (Metinfo v6.0.0 allows remote attackers to write code into a
.php file, ...)
- TODO: check
+ NOT-FOR-US: Metinfo
CVE-2018-13023
RESERVED
CVE-2018-13022
RESERVED
CVE-2018-13021 (An issue was discovered in HongCMS 3.0.0. There is an
Arbitrary Script ...)
- TODO: check
+ NOT-FOR-US: HongCMS
CVE-2018-13020
RESERVED
CVE-2018-13019
@@ -21,21 +21,21 @@ CVE-2018-13016
CVE-2018-13015
RESERVED
CVE-2018-13014 (Storing password in recoverable format in safensec.com
(SysWatch ...)
- TODO: check
+ NOT-FOR-US: SysWatch
CVE-2018-13013 (Improper check of unusual conditions when launching
msiexec.exe in ...)
- TODO: check
+ NOT-FOR-US: SysWatch
CVE-2018-13012 (Download of code with improper integrity check in snsupd.exe
and ...)
- TODO: check
+ NOT-FOR-US: SysWatch
CVE-2018-13011 (An issue was discovered in gpmf-parser 1.1.2. There is a
heap-based ...)
- TODO: check
+ NOT-FOR-US: gpmf-parser
CVE-2018-13010 (WSTMall v1.9.1_170316 has CSRF via the
index.php?m=Admin&c=Users&a=edit ...)
- TODO: check
+ NOT-FOR-US: WSTMall
CVE-2018-13009 (An issue was discovered in gpmf-parser 1.1.2. There is a
heap-based ...)
- TODO: check
+ NOT-FOR-US: gpmf-parser
CVE-2018-13008 (An issue was discovered in gpmf-parser 1.1.2. There is a
heap-based ...)
- TODO: check
+ NOT-FOR-US: gpmf-parser
CVE-2018-13007 (An issue was discovered in gpmf-parser 1.1.2. There is a
heap-based ...)
- TODO: check
+ NOT-FOR-US: gpmf-parser
CVE-2018-13006 (An issue was discovered in MP4Box in GPAC 0.7.1. There is a
heap-based ...)
TODO: check
CVE-2018-13005 (An issue was discovered in MP4Box in GPAC 0.7.1. The function
urn_Read ...)
@@ -43,29 +43,29 @@ CVE-2018-13005 (An issue was discovered in MP4Box in GPAC
0.7.1. The function ur
CVE-2018-13004
RESERVED
CVE-2018-13003 (An issue was discovered in OpenTSDB 2.3.0. There is XSS in
parameter ...)
- TODO: check
+ NOT-FOR-US: OpenTSDB
CVE-2018-13002 (An XSS issue was discovered in Inhaltsprojekte in Weblication
CMS Core ...)
- TODO: check
+ NOT-FOR-US: Weblication CMS
CVE-2018-13001 (An XSS issue was discovered in Sandoba CP:Shop v2016.1. The
...)
- TODO: check
+ NOT-FOR-US: Sandoba CP:Shop
CVE-2018-13000 (An XSS issue was discovered in Advanced Electron Forum (AEF)
v1.0.9. A ...)
- TODO: check
+ NOT-FOR-US: Advanced Electron Forum
CVE-2018-12999 (Incorrect Access Control in AgentTrayIconServlet in Zoho
ManageEngine ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2018-12998 (A reflected Cross-site scripting (XSS) vulnerability in Zoho
...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2018-12997 (Incorrect Access Control in FailOverHelperServlet in Zoho
ManageEngine ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2018-12996 (A reflected Cross-site scripting (XSS) vulnerability in Zoho
...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2018-12995 (onefilecms.php in OneFileCMS through 2012-04-14 might allow
attackers ...)
- TODO: check
+ NOT-FOR-US: OneFileCMS
CVE-2018-12994 (onefilecms.php in OneFileCMS through 2012-04-14 might allow
attackers ...)
- TODO: check
+ NOT-FOR-US: OneFileCMS
CVE-2018-12993 (onefilecms.php in OneFileCMS through 2012-04-14 might allow
attackers ...)
- TODO: check
+ NOT-FOR-US: OneFileCMS
CVE-2018-12992 (An issue was discovered CMS MaeloStore V.1.5.0. There is
stored XSS in ...)
- TODO: check
+ NOT-FOR-US: CMS MaeloStore
CVE-2018-12991
RESERVED
CVE-2018-12990
@@ -959,7 +959,7 @@ CVE-2018-1000531 (inversoft prime-jwt version prior to
commit ...)
CVE-2018-1000530
REJECTED
CVE-2018-1000529 (Grails Fields plugin version 2.2.7 contains a Cross Site
Scripting ...)
- TODO: check
+ NOT-FOR-US: Grails Fields plugin
CVE-2018-1000528 (GONICUS GOsa version before commit ...)
- gosa <unfixed> (low)
NOTE:
https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001
@@ -1454,9 +1454,9 @@ CVE-2018-12467
CVE-2018-12466
RESERVED
CVE-2018-12465 (An OS command injection vulnerability in the web
administration ...)
- TODO: check
+ NOT-FOR-US: Micro Focus
CVE-2018-12464 (A SQL injection vulnerability in the web administration and
quarantine ...)
- TODO: check
+ NOT-FOR-US: Micro Focus
CVE-2018-12463
RESERVED
CVE-2018-12462
@@ -10467,9 +10467,9 @@ CVE-2018-8904 (In Windows Master (aka Windows
Optimization Master) 7.99.13.604,
CVE-2018-8903 (Open-AudIT Professional 2.1 allows XSS via the Name or
Description ...)
NOT-FOR-US: Open-AudIT Professional
CVE-2018-8902 (An issue was discovered in Ivanti Avalanche for all versions
between ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2018-8901 (An issue was discovered in Ivanti Avalanche for all versions
between ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2018-8900 (The License Manager service of HASP SRM, Sentinel HASP and
Sentinel ...)
NOT-FOR-US: HASP SRM
CVE-2018-8899 (IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before
2.1.3 ...)
@@ -38525,37 +38525,37 @@ CVE-2017-16227 (The aspath_put function in
bgpd/bgp_aspath.c in Quagga before 1.
NOTE:
https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html
NOTE:
http://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d98833069a88e6fddb9285008
CVE-2017-16226 (The static-eval module is intended to evaluate
statically-analyzable ...)
- TODO: check
+ NOT-FOR-US: static-eval module
CVE-2017-16225 (aegir is a module to help automate JavaScript project
management. ...)
- TODO: check
+ NOT-FOR-US: aegir
CVE-2017-16224 (st is a module for serving static files. An attacker is able
to craft ...)
- TODO: check
+ NOT-FOR-US: st
CVE-2017-16223 (nodeaaaaa is a static file server. nodeaaaaa is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: nodeaaaaa
CVE-2017-16222 (elding is a simple web server. elding is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: elding
CVE-2017-16221 (yzt is a simple file server. yzt is vulnerable to a directory
...)
- TODO: check
+ NOT-FOR-US: yzt
CVE-2017-16220 (wind-mvc is an mvc framework. wind-mvc is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: wind-mvc
CVE-2017-16219 (yttivy is a static file server. yttivy is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: yttivy
CVE-2017-16218 (dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable
to a ...)
- TODO: check
+ NOT-FOR-US: dgard8.lab6
CVE-2017-16217 (fbr-client sends files through sockets via socket.io and
webRTC. ...)
- TODO: check
+ NOT-FOR-US: fbr-client
CVE-2017-16216 (tencent-server is a simple web server. tencent-server is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: tencent-server
CVE-2017-16215 (sgqserve is a simple file server. sgqserve is vulnerable to a
...)
- TODO: check
+ NOT-FOR-US: sgqserve
CVE-2017-16214 (peiserver is a static file server. peiserver is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: peiserver
CVE-2017-16213 (mfrserver is a simple file server. mfrserver is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: mfrserver
CVE-2017-16212 (ltt is a static file server. ltt is vulnerable to a directory
...)
- TODO: check
+ NOT-FOR-US: ltt
CVE-2017-16211 (lessindex is a static file server. lessindex is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: lessindex
CVE-2017-16210 (jn_jj_server is a static file server. jn_jj_server is
vulnerable to a ...)
TODO: check
CVE-2017-16209 (enserver is a simple web server. enserver is vulnerable to a
directory ...)
@@ -47787,7 +47787,7 @@ CVE-2017-13074
CVE-2017-13073 (Cross-site scripting (XSS) vulnerability in QNAP NAS
application Photo ...)
NOT-FOR-US: NAP NAS application Photo Station
CVE-2017-13072 (Cross-site scripting (XSS) vulnerability in App Center in QNAP
QTS ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2017-13071 (QNAP has already patched this vulnerability. This security
concern ...)
NOT-FOR-US: QNAP
CVE-2017-13070 (A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe)
version ...)
@@ -51281,7 +51281,7 @@ CVE-2017-12094 (An exploitable vulnerability exists in
the WiFi Channel parsing
CVE-2017-12093 (An exploitable insufficient resource pool vulnerability exists
in the ...)
NOT-FOR-US: Allen Bradley Micrologix
CVE-2017-12092 (An exploitable file write vulnerability exists in the memory
module ...)
- TODO: check
+ NOT-FOR-US: Allen Bradley Micrologix
CVE-2017-12091
REJECTED
CVE-2017-12090 (An exploitable denial of service vulnerability exists in the
...)
@@ -51320,13 +51320,13 @@ CVE-2017-12080 (An information exposure vulnerability
in default HTTP configurat
CVE-2017-12079 (Files or directories accessible to external parties
vulnerability in ...)
NOT-FOR-US: Synology Photo Station
CVE-2017-12078 (Command injection vulnerability in EZ-Internet in Synology
Router ...)
- TODO: check
+ NOT-FOR-US: Synology
CVE-2017-12077 (Uncontrolled Resource Consumption vulnerability in ...)
NOT-FOR-US: Synology
CVE-2017-12076 (Uncontrolled Resource Consumption vulnerability in ...)
NOT-FOR-US: Synology
CVE-2017-12075 (Command injection vulnerability in EZ-Internet in Synology
DiskStation ...)
- TODO: check
+ NOT-FOR-US: Synology
CVE-2017-12074 (Directory traversal vulnerability in the ...)
NOT-FOR-US: Synology
CVE-2017-12073
@@ -51336,7 +51336,7 @@ CVE-2017-12072 (Cross-site scripting (XSS)
vulnerability in PixlrEditorHandler.p
CVE-2017-12071 (Server-side request forgery (SSRF) vulnerability in
file_upload.php in ...)
NOT-FOR-US: Synology
CVE-2017-12070 (Unsigned versions of the DLLs distributed by the OPC
Foundation may be ...)
- TODO: check
+ NOT-FOR-US: OPC Foundation
CVE-2017-12069 (An XXE vulnerability has been identified in OPC Foundation UA
.NET ...)
NOT-FOR-US: OPC Foundation UA .NET Sampe code and Local Discovery
Server affecting various vendors
CVE-2017-12068 (The Event List plugin 0.7.9 for WordPress has XSS in the slug
array ...)
@@ -52321,7 +52321,7 @@ CVE-2017-11674 (Reporter.exe in Acunetix 8 allows
remote attackers to cause a de
CVE-2017-11673 (Reporter.exe in Acunetix 8 allows remote attackers to execute
arbitrary ...)
NOT-FOR-US: Acunetix
CVE-2017-11672 (The OPC Foundation Local Discovery Server (LDS) before
1.03.367 is ...)
- TODO: check
+ NOT-FOR-US: OPC Foundation Local Discovery Server
CVE-2017-11671 (Under certain circumstances, the ix86_expand_builtin function
in i386.c ...)
- gcc-6 6.3.0-12
- gcc-5 5.4.1-10
@@ -54153,11 +54153,11 @@ CVE-2017-1000025 (GNOME Web (Epiphany) 3.23 before
3.23.5, 3.22 before 3.22.6, 3
CVE-2017-1000024 (Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is
vulnerable ...)
- shotwell 0.25.4+really0.24.5-0.1 (unimportant)
CVE-2017-1000023 (LogicalDoc Community Edition 7.5.3 and prior is vulnerable
to an XSS when using preview on HTML document. ...)
- TODO: check
+ NOT-FOR-US: LogicalDoc Community Edition
CVE-2017-1000022 (LogicalDoc Community Edition 7.5.3 and prior contain an
Incorrect access control which could leave to privilege escalation. ...)
- TODO: check
+ NOT-FOR-US: LogicalDoc Community Edition
CVE-2017-1000021 (LogicalDoc Community Edition 7.5.3 and prior is vulnerable
to XXE when indexing XML documents. ...)
- TODO: check
+ NOT-FOR-US: LogicalDoc Community Edition
CVE-2017-1000020 (SYN Flood or FIN Flood attack in ECos 1 and other versions
embedded ...)
NOT-FOR-US: ECos
CVE-2017-1000018 (phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack
in the ...)
@@ -59398,7 +59398,7 @@ CVE-2017-9314 (Authentication vulnerability found in
Dahua NVR models NVR50XX, .
CVE-2017-9313 (Multiple Cross-site scripting (XSS) vulnerabilities in Webmin
before ...)
- webmin <removed>
CVE-2017-9312 (Improperly implemented option-field processing in the TCP/IP
stack on ...)
- TODO: check
+ NOT-FOR-US: Allen-Bradley
CVE-2017-9311
RESERVED
CVE-2017-9309
@@ -63490,11 +63490,11 @@ CVE-2017-7935 (A Resource Exhaustion issue was
discovered in Phoenix Contact Gmb
CVE-2017-7934 (An Improper Authentication issue was discovered in OSIsoft PI
Server ...)
NOT-FOR-US: OSIsoft
CVE-2017-7933 (In ABB IP GATEWAY 3.39 and prior, some configuration files
contain ...)
- TODO: check
+ NOT-FOR-US: ABB
CVE-2017-7932 (An improper certificate validation issue was discovered in NXP
i.MX 28 ...)
NOT-FOR-US: NXP i.MX devices
CVE-2017-7931 (In ABB IP GATEWAY 3.39 and prior, by accessing a specific
uniform ...)
- TODO: check
+ NOT-FOR-US: ABB
CVE-2017-7930 (An Improper Authentication issue was discovered in OSIsoft PI
Server ...)
NOT-FOR-US: OSIsoft
CVE-2017-7929 (An Absolute Path Traversal issue was discovered in Advantech
WebAccess ...)
@@ -63544,7 +63544,7 @@ CVE-2017-7908
CVE-2017-7907 (An Improper XML Parser Configuration issue was discovered in
Schneider ...)
NOT-FOR-US: Schneider
CVE-2017-7906 (In ABB IP GATEWAY 3.39 and prior, the web server does not
sufficiently ...)
- TODO: check
+ NOT-FOR-US: ABB
CVE-2017-7905 (A Weak Cryptography for Passwords issue was discovered in
General ...)
NOT-FOR-US: General Electric
CVE-2017-7904
@@ -64731,15 +64731,15 @@ CVE-2017-7641 (QNAP NAS application Media Streaming
add-on version 421.1.0.2, ..
CVE-2017-7640 (QNAP NAS application Media Streaming add-on version 421.1.0.2,
...)
NOT-FOR-US: QNAP NAS application Media Streaming add-on
CVE-2017-7639 (QNAP NAS application Proxy Server through version 1.2.0 does
not ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2017-7638 (QNAP NAS application Media Streaming add-on version 421.1.0.2,
...)
NOT-FOR-US: QNAP NAS application Media Streaming add-on
CVE-2017-7637 (QNAP NAS application Proxy Server through version 1.2.0 allows
remote ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2017-7636 (Cross-site scripting (XSS) vulnerability in QNAP NAS
application Proxy ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2017-7635 (QNAP NAS application Proxy Server through version 1.2.0 does
not ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2017-7634 (Cross-site scripting (XSS) vulnerability in QNAP NAS
application Media ...)
NOT-FOR-US: QNAP NAS application Media Streaming add-on
CVE-2017-7633 (QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive
...)
@@ -67728,7 +67728,7 @@ CVE-2017-6781 (A vulnerability in the management of
shell user accounts for Cisc
CVE-2017-6780 (A vulnerability in the TCP throttling process for Cisco IoT
Field ...)
NOT-FOR-US: Cisco
CVE-2017-6779 (Multiple Cisco products are affected by a vulnerability in
local file ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2017-6778 (A vulnerability in the Elastic Services Controller (ESC) web
interface ...)
NOT-FOR-US: Cisco
CVE-2017-6777 (A vulnerability in the ConfD server of the Cisco Elastic
Services ...)
@@ -69288,15 +69288,15 @@ CVE-2017-6296 (NVIDIA TrustZone Software contains a
TOCTOU issue in the DRM ...)
CVE-2017-6295 (NVIDIA TrustZone Software contains a vulnerability in the
Keymaster ...)
NOT-FOR-US: NVIDIA
CVE-2017-6294 (In Android before the 2018-06-05 security patch level, NVIDIA
Tegra X1 ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2017-6293 (In Android before the 2018-05-05 security patch level, NVIDIA
Tegra X1 ...)
NOT-FOR-US: Nvidia component for Android
CVE-2017-6292 (In Android before the 2018-06-05 security patch level, NVIDIA
TLZ ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2017-6291
RESERVED
CVE-2017-6290 (In Android before the 2018-06-05 security patch level, NVIDIA
TLK ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2017-6289 (In Android before the 2018-05-05 security patch level, NVIDIA
Trusted ...)
NOT-FOR-US: Nvidia component for Android
CVE-2017-6288 (NVIDIA libnvrm contains a possible out of bounds read due to a
missing ...)
@@ -69634,7 +69634,7 @@ CVE-2017-6155 (On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1,
11.6.0-11.6.2, 11.4.1-11.5.
CVE-2017-6154 (On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or
11.6.1 - ...)
NOT-FOR-US: F5 BIG-IP
CVE-2017-6153 (Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, ...)
- TODO: check
+ NOT-FOR-US: F5 BIG-IP
CVE-2017-6152 (A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0
with the ...)
NOT-FOR-US: F5 BIG-IQ Centralized Management
CVE-2017-6151 (In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge
Gateway, ...)
@@ -76094,7 +76094,7 @@ CVE-2017-3970
CVE-2017-3969 (Abuse of communication channels vulnerability in the server in
McAfee ...)
NOT-FOR-US: McAfee
CVE-2017-3968 (Session fixation vulnerability in the web interface in McAfee
Network ...)
- TODO: check
+ NOT-FOR-US: McAfee
CVE-2017-3967 (Target influence via framing vulnerability in the web interface
in ...)
NOT-FOR-US: McAfee
CVE-2017-3966 (Exploitation of session variables, resource IDs and other
trusted ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/13f8514cb9e853fb23cf4df0ed38d6d2fe86dd3f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/13f8514cb9e853fb23cf4df0ed38d6d2fe86dd3f
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
