Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3c130d0b by Moritz Muehlenhoff at 2019-10-23T21:36:04Z
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
CVE-2019-18359 (A buffer over-read was discovered in ReadMP3APETag in apetag.c
in MP3G ...)
- TODO: check
+ - mp3gain <removed>
CVE-2019-18358
RESERVED
CVE-2019-18357 (An XSS issue was discovered in Thycotic Secret Server before
10.7 (iss ...)
- TODO: check
+ NOT-FOR-US: Thycotic Secret Server
CVE-2019-18356 (An XSS issue was discovered in Thycotic Secret Server before
10.7 (iss ...)
- TODO: check
+ NOT-FOR-US: Thycotic Secret Server
CVE-2019-18355 (An SSRF issue was discovered in the legacy Web launcher in
Thycotic Se ...)
- TODO: check
+ NOT-FOR-US: Thycotic Secret Server
CVE-2019-18354
RESERVED
CVE-2019-18353
@@ -17,7 +17,7 @@ CVE-2019-18352
CVE-2019-18351
RESERVED
CVE-2019-18350 (In Ant Design Pro 4.0.0, reflected XSS in the user/login
redirect GET ...)
- TODO: check
+ NOT-FOR-US: Ant Design Pro
CVE-2019-18349
RESERVED
CVE-2019-18348 (An issue was discovered in urllib2 in Python 2.x through
2.7.17 and ur ...)
@@ -29,7 +29,7 @@ CVE-2019-18346
CVE-2019-18345
RESERVED
CVE-2019-18344 (Sourcecodester Online Grading System 1.0 is vulnerable to
unauthentica ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester Online Grading System
CVE-2019-18343
RESERVED
CVE-2019-18342
@@ -157,11 +157,11 @@ CVE-2019-18282
CVE-2019-18281 (An out-of-bounds memory access in the
generateDirectionalRuns() functi ...)
TODO: check
CVE-2019-18280 (Sourcecodester Online Grading System 1.0 is affected by a
Cross Site R ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester Online Grading System
CVE-2019-18279
RESERVED
CVE-2019-18278 (When executing VideoLAN VLC media player 3.0.8 with libqt on
Windows, ...)
- TODO: check
+ NOT-FOR-US: VLC on Windows
CVE-2019-18277 (A flaw was found in HAProxy before 2.0.6. In legacy mode,
messages fea ...)
TODO: check
CVE-2019-18276
@@ -281,9 +281,9 @@ CVE-2019-18222
CVE-2019-18221
RESERVED
CVE-2019-18220 (Sitemagic CMS 4.4.1 is affected by a
Cross-Site-Request-Forgery (CSRF) ...)
- TODO: check
+ NOT-FOR-US: Sitemagic CMS
CVE-2019-18219 (Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting
(XSS) vulner ...)
- TODO: check
+ NOT-FOR-US: Sitemagic CMS
CVE-2019-18218 (cdf_read_property_info in cdf.c in file through 5.37 does not
restrict ...)
- file 1:5.37-6 (bug #942830)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780
@@ -2545,7 +2545,7 @@ CVE-2019-17608 (HongCMS 3.0.0 has XSS via the
install/index.php dbname parameter
CVE-2019-17607 (HongCMS 3.0.0 has XSS via the install/index.php servername
parameter. ...)
NOT-FOR-US: HongCMS
CVE-2019-17606 (The Post editor functionality in the hexo-admin plugin
versions 2.3.0 ...)
- TODO: check
+ NOT-FOR-US: hexo-admin Node module
CVE-2019-17605
RESERVED
CVE-2019-17604
@@ -2693,75 +2693,75 @@ CVE-2019-17549
CVE-2019-17548
RESERVED
CVE-2015-9536 (The Easy Digital Downloads (EDD) Twenty-Twelve theme for
WordPress, as ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9535 (The Easy Digital Downloads (EDD) Shoppette theme for WordPress,
as use ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9534 (The Easy Digital Downloads (EDD) Quota theme for WordPress, as
used wi ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9533 (The Easy Digital Downloads (EDD) Lattice theme for WordPress,
as used ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9532 (The Easy Digital Downloads (EDD) Digital Store theme for
WordPress, as ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9531 (The Easy Digital Downloads (EDD) Wish Lists extension for
WordPress, a ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9530 (The Easy Digital Downloads (EDD) Upload File extension for
WordPress, ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9529 (The Easy Digital Downloads (EDD) Stripe extension for
WordPress, as us ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9528 (The Easy Digital Downloads (EDD) Software Licensing extension
for Word ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9527 (The Easy Digital Downloads (EDD) Simple Shipping extension for
WordPre ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9526 (The Easy Digital Downloads (EDD) Reviews extension for
WordPress, as u ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9525 (The Easy Digital Downloads (EDD) Recurring Payments extension
for Word ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9524 (The Easy Digital Downloads (EDD) Recount Earnings extension for
WordPr ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9523 (The Easy Digital Downloads (EDD) Recommended Products extension
for Wo ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9522 (The Easy Digital Downloads (EDD) QR Code extension for
WordPress, as u ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9521 (The Easy Digital Downloads (EDD) Pushover Notifications
extension for ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9520 (The Easy Digital Downloads (EDD) Per Product Emails extension
for Word ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9519 (The Easy Digital Downloads (EDD) PDF Stamper extension for
WordPress, ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9518 (The Easy Digital Downloads (EDD) PDF Invoices extension for
WordPress, ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9517 (The Easy Digital Downloads (EDD) Manual Purchases extension for
WordPr ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9516 (The Easy Digital Downloads (EDD) Invoices extension for
WordPress, as ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9515 (The Easy Digital Downloads (EDD) htaccess Editor extension for
WordPre ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9514 (The Easy Digital Downloads (EDD) Free Downloads extension for
WordPres ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9513 (The Easy Digital Downloads (EDD) Favorites extension for
WordPress, as ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9512 (The Easy Digital Downloads (EDD) CSV Manager extension for
WordPress, ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9511 (The Easy Digital Downloads (EDD) Conditional Success Redirects
extensi ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9510 (The Easy Digital Downloads (EDD) Cross-sell Upsell extension
for WordP ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9509 (The Easy Digital Downloads (EDD) Content Restriction extension
for Wor ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9508 (The Easy Digital Downloads (EDD) Commissions extension for
WordPress, ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9507 (The Easy Digital Downloads (EDD) Attach Accounts to Orders
extension f ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9506 (The Easy Digital Downloads (EDD) Amazon S3 extension for
WordPress, as ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9505 (The Easy Digital Downloads (EDD) core component 1.8.x before
1.8.7, 1. ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9504 (The weeklynews theme before 2.2.9 for WordPress has XSS via the
s para ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2015-9503 (The Modern theme before 1.4.2 for WordPress has XSS via the
genericons ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9502 (The Auberge theme before 1.4.5 for WordPress has XSS via the
genericon ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2015-9501 (The Artificial Intelligence theme before 1.2.4 for WordPress
has XSS b ...)
NOT-FOR-US: Wordpress plugin
CVE-2015-9500 (The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has
XSS via ...)
@@ -3885,7 +3885,7 @@ CVE-2019-17095
CVE-2019-17094
RESERVED
CVE-2019-17093 (An issue was discovered in Avast antivirus before 19.8 and AVG
antivir ...)
- TODO: check
+ NOT-FOR-US: Avast
CVE-2019-17092 (An XSS vulnerability in project list in OpenProject before
9.0.4 and 1 ...)
NOT-FOR-US: OpenProject
CVE-2019-17091 (faces/context/PartialViewContextImpl.java in Eclipse Mojarra,
as used ...)
@@ -4156,11 +4156,11 @@ CVE-2019-16979 (In FusionPBX up to v4.5.7, the file
app\contacts\contact_urls.ph
CVE-2019-16978 (In FusionPBX up to v4.5.7, the file
app\devices\device_settings.php us ...)
NOT-FOR-US: FusionPBX
CVE-2019-16977 (In FusionPBX up to 4.5.7, the file
app\extensions\extension_imports.ph ...)
- TODO: check
+ NOT-FOR-US: FusionPBX
CVE-2019-16976 (In FusionPBX up to 4.5.7, the file
app\destinations\destination_import ...)
- TODO: check
+ NOT-FOR-US: FusionPBX
CVE-2019-16975 (In FusionPBX up to 4.5.7, the file
app\contacts\contact_notes.php uses ...)
- TODO: check
+ NOT-FOR-US: FusionPBX
CVE-2019-16974 (In FusionPBX up to 4.5.7, the file
app\contacts\contact_times.php uses ...)
NOT-FOR-US: FusionPBX
CVE-2019-16973 (In FusionPBX up to 4.5.7, the file
app\contacts\contact_edit.php uses ...)
@@ -12624,7 +12624,7 @@ CVE-2019-14278 (In Knowage through 6.1.1, an
unauthenticated user can enumerated
CVE-2019-14277 (** DISPUTED ** Axway SecureTransport 5.x through 5.3 (or 5.x
through 5 ...)
NOT-FOR-US: Axway SecureTransport
CVE-2019-14276 (WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.
...)
- TODO: check
+ NOT-FOR-US: WUSTL XNAT
CVE-2019-14275 (Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the
calc_arro ...)
- fig2dev 1:3.2.7a-7 (unimportant; bug #933075)
[buster] - fig2dev 1:3.2.7a-5+deb10u1
@@ -19643,7 +19643,7 @@ CVE-2019-11935
CVE-2019-11934
RESERVED
CVE-2019-11933 (A heap buffer overflow bug in libpl_droidsonroids_gif before
1.2.19, a ...)
- TODO: check
+ NOT-FOR-US: libpl_droidsonroids_gif
CVE-2019-11932 (A double free vulnerability in the DDGifSlurp function in
decoding.c i ...)
NOT-FOR-US: libpl_droidsonroids_gif
CVE-2019-11931
@@ -21582,9 +21582,9 @@ CVE-2019-11285
CVE-2019-11284 (Pivotal Reactor Netty, versions prior to 0.8.11, passes
headers throug ...)
NOT-FOR-US: Pivotal
CVE-2019-11283 (Cloud Foundry SMB Volume, versions prior to v2.0.3,
accidentally outpu ...)
- TODO: check
+ NOT-FOR-US: Cloud Foundry
CVE-2019-11282 (Cloud Foundry UAA, versions prior to v74.3.0, contains an
endpoint tha ...)
- TODO: check
+ NOT-FOR-US: Cloud Foundry
CVE-2019-11281 (Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for
PCF, ver ...)
- rabbitmq-server 3.7.18-1 (low)
[jessie] - rabbitmq-server <no-dsa> (Minor issue; one plugin not
vulnerable, the other only exploitable by malicious admin)
@@ -23688,7 +23688,7 @@ CVE-2019-10478 (An issue was discovered on Glory
RBW-100 devices with firmware I
CVE-2019-10477 (The FusionInventory plugin before 1.4 for GLPI 9.3.x and
before 1.1 fo ...)
NOT-FOR-US: GLPI plugin
CVE-2019-10476 (Jenkins Zulip Plugin 1.1.0 and earlier stored credentials
unencrypted ...)
- TODO: check
+ NOT-FOR-US: Jenkins plugin
CVE-2019-10475 (A reflected cross-site scripting vulnerability in Jenkins
build-metric ...)
NOT-FOR-US: Jenkins plugin
CVE-2019-10474 (A missing permission check in Jenkins Global Post Script
Plugin in all ...)
@@ -27156,9 +27156,9 @@ CVE-2019-9599 (The AirDroid application through 4.2.1.6
for Android allows remot
CVE-2019-9598 (An issue was discovered in Cscms 4.1.0. There is an
admin.php/pay CSRF ...)
NOT-FOR-US: Cscms
CVE-2019-9597 (Darktrace Enterprise Immune System before 3.1 allows CSRF via
the /con ...)
- TODO: check
+ NOT-FOR-US: Darktrace Enterprise Immune System
CVE-2019-9596 (Darktrace Enterprise Immune System before 3.1 allows CSRF via
the /whi ...)
- TODO: check
+ NOT-FOR-US: Darktrace Enterprise Immune System
CVE-2019-9595 (AppCMS 2.0.101 allows XSS via the upload/callback.php params
parameter ...)
NOT-FOR-US: AppCMS
CVE-2019-9594 (BlueCMS 1.6 allows SQL Injection via the user_id parameter in
an uploa ...)
@@ -36053,7 +36053,7 @@ CVE-2019-6146
CVE-2019-6145 (Forcepoint VPN Client for Windows versions lower than 6.6.1
have an un ...)
NOT-FOR-US: Forcepoint
CVE-2019-6144 (This vulnerability allows a normal (non-admin) user to disable
the For ...)
- TODO: check
+ NOT-FOR-US: Forcepoint
CVE-2019-6143 (Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x
before 6.4 ...)
NOT-FOR-US: Forcepoint Next Generation Firewall (Forcepoint NGFW)
CVE-2019-6142
@@ -41003,7 +41003,7 @@ CVE-2019-3984
CVE-2019-3983
RESERVED
CVE-2019-3982 (Nessus versions 8.6.0 and earlier were found to contain a
Denial of Se ...)
- TODO: check
+ NOT-FOR-US: Nessus
CVE-2019-3981
RESERVED
CVE-2019-3980 (The Solarwinds Dameware Mini Remote Client agent v12.1.0.89
supports s ...)
@@ -233884,7 +233884,7 @@ CVE-2014-2306
CVE-2014-2305
RESERVED
CVE-2014-2304 (A vulnerability in version 0.90 of the Open Floodlight SDN
controller ...)
- TODO: check
+ NOT-FOR-US: Open Floodlight
CVE-2014-2303 (Multiple SQL injection vulnerabilities in the file browser
component ( ...)
NOT-FOR-US: webEdition CMS
CVE-2014-2302 (The installer script in webEdition CMS before 6.2.7-s1 and
6.3.x befor ...)
@@ -233951,7 +233951,7 @@ CVE-2014-2281 (The nfs_name_snoop_add_name function
in epan/dissectors/packet-nf
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672
NOTE: http://www.wireshark.org/security/wnpa-sec-2014-01.html
CVE-2013-7333 (A vulnerability in version 0.90 of the Open Floodlight SDN
controller ...)
- TODO: check
+ NOT-FOR-US: Open Floodlight
CVE-2014-2309 (The ip6_route_add function in net/ipv6/route.c in the Linux
kernel thr ...)
- linux 3.13.6-1
[wheezy] - linux 3.2.57-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c130d0befe7ded291c87a81f1590ca5c1be50ee
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c130d0befe7ded291c87a81f1590ca5c1be50ee
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
