Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
df5062e8 by Moritz Muehlenhoff at 2018-06-30T22:27:38+02:00
NFUs
obs n/a
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -1,7 +1,7 @@
CVE-2018-13031
RESERVED
CVE-2018-13030 (An issue was discovered in jpeg-compressor 0.1. The
build_huffman ...)
- TODO: check
+ NOT-FOR-US: jpeg-compressor
CVE-2018-13029
RESERVED
CVE-2018-13028
@@ -9,7 +9,7 @@ CVE-2018-13028
CVE-2018-13027
RESERVED
CVE-2018-13026 (An issue was discovered in gpmf-parser 1.1.2. There is a
heap-based ...)
- TODO: check
+ NOT-FOR-US: gpmf-parser
CVE-2018-13025 (protected/apps/admin/controller/photoController.php in YXcms
1.4.7 ...)
NOT-FOR-US: YXcms
CVE-2018-13024 (Metinfo v6.0.0 allows remote attackers to write code into a
.php file, ...)
@@ -81,7 +81,7 @@ CVE-2018-12992 (An issue was discovered CMS MaeloStore
V.1.5.0. There is stored
CVE-2018-12991
RESERVED
CVE-2018-12990 (phpwcms 1.8.9 allows remote attackers to discover the
installation path ...)
- TODO: check
+ NOT-FOR-US: phpwcms
CVE-2018-12989
RESERVED
CVE-2018-12988 (GreenCMS 2.3.0603 has an arbitrary file download vulnerability
via an ...)
@@ -14297,7 +14297,7 @@ CVE-2018-7477 (SQL Injection exists in PHP Scripts Mall
School Management Script
CVE-2018-7476 (controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross
Site ...)
NOT-FOR-US: FineCms
CVE-2018-7475 (Cross-site scripting (XSS) vulnerability for webdav/ticket/
URIs in ...)
- TODO: check
+ NOT-FOR-US: IceWarp
CVE-2018-7474 (An issue was discovered in Textpattern CMS 4.6.2 and earlier.
It is ...)
- textpattern <removed>
CVE-2018-7473 (Open redirect vulnerability in the SO Connect SO WIFI hotspot
web ...)
@@ -38645,45 +38645,45 @@ CVE-2017-16190 (dcdcdcdcdc is a static file server.
dcdcdcdcdc is vulnerable to
CVE-2017-16189 (sly07 is an API for censoring text. sly07 is vulnerable to a
directory ...)
NOT-FOR-US: sly07
CVE-2017-16188 (reecerver is a web server. reecerver is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: reecerver
CVE-2017-16187 (open-device creates a web interface for any device.
open-device is ...)
- TODO: check
+ NOT-FOR-US: open-device
CVE-2017-16186 (360class.jansenhm is a static file server. 360class.jansenhm
is ...)
- TODO: check
+ NOT-FOR-US: 360class.jansenhm
CVE-2017-16185 (uekw1511server is a static file server. uekw1511server is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: uekw1511server
CVE-2017-16184 (scott-blanch-weather-app is a sample Node.js app using Express
4. ...)
- TODO: check
+ NOT-FOR-US: scott-blanch-weather-app
CVE-2017-16183 (iter-server is a static file server. iter-server is vulnerable
to a ...)
- TODO: check
+ NOT-FOR-US: iter-server
CVE-2017-16182 (serverxxx is a static file server. serverxxx is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: serverxxx
CVE-2017-16181 (wintiwebdev is a static file server. wintiwebdev is vulnerable
to a ...)
- TODO: check
+ NOT-FOR-US: wintiwebdev
CVE-2017-16180 (serverabc is a static file server. serverabc is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: serverabc
CVE-2017-16179 (dasafio is a web server. dasafio is vulnerable to a directory
...)
- TODO: check
+ NOT-FOR-US: dasafio
CVE-2017-16178 (intsol-package is a file server. intsol-package is vulnerable
to a ...)
- TODO: check
+ NOT-FOR-US: intsol-package
CVE-2017-16177 (chatbyvista is a file server. chatbyvista is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: chatbyvista
CVE-2017-16176 (jansenstuffpleasework is a file server. jansenstuffpleasework
is ...)
- TODO: check
+ NOT-FOR-US: jansenstuffpleasework
CVE-2017-16175 (ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: ewgaddis.lab6
CVE-2017-16174 (whispercast is a file server. whispercast is vulnerable to a
directory ...)
- TODO: check
+ NOT-FOR-US: whispercast
CVE-2017-16173 (utahcityfinder constructs lists of Utah cities with a certain
prefix. ...)
- TODO: check
+ NOT-FOR-US: utahcityfinder
CVE-2017-16172 (section2.madisonjbrooks12 is a simple web server. ...)
- TODO: check
+ NOT-FOR-US: section2.madisonjbrooks12
CVE-2017-16171 (hcbserver is a static file server. hcbserver is vulnerable to
a ...)
- TODO: check
+ NOT-FOR-US: hcbserver
CVE-2017-16170 (liuyaserver is a static file server. liuyaserver is vulnerable
to a ...)
- TODO: check
+ NOT-FOR-US: liuyaserver
CVE-2017-16169 (looppake is a simple http server. looppake is vulnerable to a
...)
- TODO: check
+ NOT-FOR-US: looppake
CVE-2017-16168 (wffserve is vulnerable to a directory traversal issue, giving
an ...)
TODO: check
CVE-2017-16167 (yyooopack is a simple file server. yyooopack is vulnerable to
a ...)
@@ -79904,11 +79904,11 @@ CVE-2017-2862 (An exploitable heap overflow
vulnerability exists in the ...)
CVE-2017-2861 (An exploitable Denial of Service vulnerability exists in the
use of a ...)
NOT-FOR-US: Natus Xltek NeuroWorks
CVE-2017-2860 (An exploitable denial-of-service vulnerability exists in the
lookup ...)
- TODO: check
+ NOT-FOR-US: Natus Xltek NeuroWorks
CVE-2017-2859
RESERVED
CVE-2017-2858 (An exploitable denial-of-service vulnerability exists in the
traversal ...)
- TODO: check
+ NOT-FOR-US: Natus Xltek NeuroWorks
CVE-2017-2857
RESERVED
CVE-2017-2856
@@ -79920,7 +79920,7 @@ CVE-2017-2854
CVE-2017-2853 (An exploitable Code Execution vulnerability exists in the ...)
NOT-FOR-US: Natus Xltek NeuroWorks
CVE-2017-2852 (An exploitable denial-of-service vulnerability exists in the
...)
- TODO: check
+ NOT-FOR-US: Natus Xltek NeuroWorks
CVE-2017-2851 (In the web management interface in Foscam C1 Indoor HD cameras
with ...)
NOT-FOR-US: Foscam C1 Indoor HD cameras
CVE-2017-2850 (In the web management interface in Foscam C1 Indoor HD cameras
with ...)
@@ -84127,13 +84127,13 @@ CVE-2017-0933 (Ubiquiti Networks EdgeOS version 1.9.1
and prior suffer from a ..
CVE-2017-0932 (Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from
an ...)
NOT-FOR-US: Ubiquiti Networks EdgeOS
CVE-2017-0931 (html-janitor node module suffers from a Cross-Site Scripting
(XSS) ...)
- TODO: check
+ NOT-FOR-US: html-janitor node module
CVE-2017-0930 (augustine node module suffers from a Path Traversal
vulnerability due ...)
- TODO: check
+ NOT-FOR-US: augustine node module
CVE-2017-0929
RESERVED
CVE-2017-0928 (html-janitor node module suffers from an External Control of
Critical ...)
- TODO: check
+ NOT-FOR-US: html-janitor node module
CVE-2017-0927 (Gitlab Community Edition version 10.3 is vulnerable to an
improper ...)
- gitlab 10.5.5+dfsg-1 (bug #888508)
[stretch] - gitlab <not-affected> (Doesn't affect 8.x)
@@ -86358,11 +86358,11 @@ CVE-2016-9492
CVE-2016-9491
RESERVED
CVE-2016-9490 (ManageEngine Applications Manager versions 12 and 13 suffer
from a ...)
- TODO: check
+ NOT-FOR-US: ManageEngine Applications Manager
CVE-2016-9489
RESERVED
CVE-2016-9488 (ManageEngine Applications Manager versions 12 and 13 suffer
from ...)
- TODO: check
+ NOT-FOR-US: ManageEngine Applications Manager
CVE-2016-9487
RESERVED
CVE-2016-9486
@@ -90260,7 +90260,7 @@ CVE-2016-XXXX [nspr, nss: unprotected environment
variables]
NOTE:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.22.1_release_notes
NOTE: CVE Request:
http://www.openwall.com/lists/oss-security/2016/10/02/4
CVE-2016-8390 (An exploitable out of bounds write vulnerability exists in the
parsing ...)
- TODO: check
+ NOT-FOR-US: Hopper Disassembler
CVE-2016-8389 (An exploitable integer-overflow vulnerability exists within
Iceni ...)
NOT-FOR-US: Iceni Argus
CVE-2016-8388 (An exploitable arbitrary heap-overwrite vulnerability exists
within ...)
@@ -120680,7 +120680,7 @@ CVE-2015-7613 (Race condition in the IPC object
implementation in the Linux kern
- linux-2.6 <removed>
NOTE:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9a532277938798b53178d5a66af6e2915cb27cf
(v4.3-rc4)
CVE-2015-7610 (Cross-site request forgery (CSRF) vulnerability in the login
form in ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2015-7609
RESERVED
CVE-2015-7608
@@ -130560,7 +130560,7 @@ CVE-2015-4045 (The sudoers file in the asset
discovery scanner in AlienVault OSS
CVE-2015-4044
RESERVED
CVE-2015-4043 (SQL injection vulnerability in ConnX ESP HR Management 4.4.0
allows ...)
- TODO: check
+ NOT-FOR-US: ConnX ESP
CVE-2015-4040 (Directory traversal vulnerability in the configuration utility
in F5 ...)
NOT-FOR-US: F5 BIG-IP
CVE-2015-4039
@@ -166510,7 +166510,7 @@ CVE-2014-0594 (In the Open Build Service (OBS) before
version 2.4.6 the CSRF ...
NOTE:
https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8
NOTE: https://bugzilla.suse.com/show_bug.cgi?id=870606
CVE-2014-0593 (The set_version script as shipped with obs-service-set_version
is a ...)
- TODO: check
+ NOT-FOR-US: script for OBS
CVE-2014-0592 (Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework,
as used ...)
NOT-FOR-US: Crowbar
CVE-2014-0591 (The query_findclosestnsec3 function in query.c in named in ISC
BIND ...)
@@ -204087,7 +204087,7 @@ CVE-2012-0435 (SUSE WebYaST before 1.2 0.2.63-0.6.1
allows remote attackers to m
CVE-2012-0434 (The server in Crowbar, as used in SUSE Cloud 1.0, uses weak ...)
NOT-FOR-US: Crowbar
CVE-2012-0433 (The install-chef-suse.sh script shipped with crowbar before
2012-10-02 ...)
- TODO: check
+ NOT-FOR-US: crowbar
CVE-2012-0432 (Stack-based buffer overflow in the Novell NCP implementation in
NetIQ ...)
NOT-FOR-US: NetIQ eDirectory
CVE-2012-0431
@@ -207579,7 +207579,7 @@ CVE-2011-4192 (kiwi before 4.85.1, as used in SUSE
Studio Onsite 1.2 before 1.2.
CVE-2011-4191 (Stack-based buffer overflow in the xdrDecodeString function in
...)
NOT-FOR-US: Novell NetWare
CVE-2011-4190 (The kdump implementation is missing the host key verification
in the ...)
- TODO: check
+ NOT-FOR-US: kdump as used in SuSE
CVE-2011-4189 (The client in Novell GroupWise 8.0x through 8.02HP3 allows
remote ...)
NOT-FOR-US: Novell GroupWise
CVE-2011-4188 (Buffer overflow in the Create Attribute function in jclient in
Novell ...)
@@ -207593,7 +207593,9 @@ CVE-2011-4185 (The GetPrinterURLList2 method in the
ActiveX control in Novell iP
CVE-2011-4184
RESERVED
CVE-2011-4183 (A vulnerability in open build service allows remote attackers
to ...)
- TODO: check
+ - open-build-service <not-affected> (Fixed before initial upload to
Debian)
+ NOTE: https://bugzilla.suse.com/show_bug.cgi?id=736243
+ NOTE:
https://github.com/openSUSE/open-build-service/commit/5281e4bff9df31f1f91e22a0d1e9086b93b23d7e
CVE-2011-4182 (Missing escaping of ESSID values in sysconfig of SUSE Linux
Enterprise ...)
NOT-FOR-US: sysconfig in SUSE Linux Enterprise
CVE-2011-4181 (A vulnerability in open build service allows remote attackers
to gain ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/df5062e86cb2bf8c5b3c93c14d14534046d7be22
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/df5062e86cb2bf8c5b3c93c14d14534046d7be22
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
