Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
27e598cb by Moritz Muehlenhoff at 2020-05-14T22:41:24+02:00
new libspring-security-2.0-java, glpi issues
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -18537,13 +18537,13 @@ CVE-2020-5579
CVE-2020-5578
RESERVED
CVE-2020-5577 (Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier
(Movabl ...)
- TODO: check
+ - movabletype-opensource <removed>
CVE-2020-5576 (Cross-site request forgery (CSRF) vulnerability in Movable Type
series ...)
- TODO: check
+ - movabletype-opensource <removed>
CVE-2020-5575 (Cross-site scripting vulnerability in Movable Type series
(Movable Typ ...)
- TODO: check
+ - movabletype-opensource <removed>
CVE-2020-5574 (HTML attribute value injection vulnerability in Movable Type
series (M ...)
- TODO: check
+ - movabletype-opensource <removed>
CVE-2020-5573
RESERVED
CVE-2020-5572
@@ -18934,9 +18934,9 @@ CVE-2020-5410
CVE-2020-5409 (Pivotal Concourse, most versions prior to 6.0.0, allows
redirects to u ...)
NOT-FOR-US: Pivotal
CVE-2020-5408 (Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to
5.2.4, 5 ...)
- TODO: check
+ - libspring-security-2.0-java <removed>
CVE-2020-5407 (Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior
to 5.3.2 ...)
- TODO: check
+ - libspring-security-2.0-java <removed>
CVE-2020-5406 (VMware Tanzu Application Service for VMs, 2.6.x versions prior
to 2.6. ...)
NOT-FOR-US: VMware
CVE-2020-5405 (Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions
2.1.x pri ...)
@@ -19351,7 +19351,10 @@ CVE-2020-5249 (In Puma (RubyGem) before 4.3.3 and
3.12.4, if an application usin
NOTE:
https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
NOTE:
https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
CVE-2020-5248 (GLPI before before version 9.4.6 has a vulnerability involving
a defau ...)
- TODO: check
+ - glpi <removed> (unimportant)
+ NOTE: Only supported behind an authenticated HTTP zone
+ NOTE:
https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9
+ NOTE:
https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
CVE-2020-5247 (In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an
application us ...)
- puma 3.12.4-1 (bug #952766)
NOTE:
https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
@@ -22173,7 +22176,7 @@ CVE-2020-4094
CVE-2020-4093
RESERVED
CVE-2020-4092 ("If port encryption is not enabled on the Domino Server, HCL
Nomad on ...)
- TODO: check
+ NOT-FOR-US: HCL Nomad
CVE-2020-4091
RESERVED
CVE-2020-4090
@@ -28169,35 +28172,35 @@ CVE-2020-2009 (An external control of filename
vulnerability in the SD WAN compo
CVE-2020-2008 (An OS command injection and external control of filename
vulnerability ...)
NOT-FOR-US: PAN-OS
CVE-2020-2007 (An OS command injection vulnerability in the management server
compone ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2006 (A stack-based buffer overflow vulnerability in the management
server c ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2005 (A cross-site scripting (XSS) vulnerability exists when visiting
malici ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2004 (Under certain circumstances a user's password may be logged in
clearte ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2003 (An external control of filename vulnerability in the command
processin ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2002 (An authentication bypass by spoofing vulnerability exists in
the authe ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2001 (An external control of path and data vulnerability in the Palo
Alto Ne ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-2000
RESERVED
CVE-2020-1999
RESERVED
CVE-2020-1998 (An improper authorization vulnerability in PAN-OS that
mistakenly uses ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1997 (An open redirection vulnerability in the GlobalProtect
component of Pa ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1996 (A missing authorization vulnerability in the management server
compone ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1995 (A NULL pointer dereference vulnerability in Palo Alto Networks
PAN-OS ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1994 (A predictable temporary file vulnerability in PAN-OS allows a
local au ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1993 (The GlobalProtect Portal feature in PAN-OS does not set a new
session ...)
- TODO: check
+ NOT-FOR-US: PAN-OS
CVE-2020-1992 (A format string vulnerability in the Varrcvr daemon of PAN-OS
on PA-70 ...)
NOT-FOR-US: Palo Alto Networks
CVE-2020-1991 (An insecure temporary file vulnerability in Palo Alto Networks
Traps a ...)
@@ -30401,7 +30404,7 @@ CVE-2019-19104 (The web server in ABB Telephone Gateway
TG/S 3.2 and Busch-Jaege
CVE-2019-19103
RESERVED
CVE-2019-19102 (A directory traversal vulnerability in SharpZipLib used in the
upgrade ...)
- TODO: check
+ NOT-FOR-US: B&R Automation Studio
CVE-2019-19101 (A missing secure communication definition and an incomplete
TLS valida ...)
NOT-FOR-US: B&R Automation Studio
CVE-2019-19100 (A privilege escalation vulnerability in the upgrade service in
B&R ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e598cbe899e2fa3fd7103f5c2a8831d447987c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e598cbe899e2fa3fd7103f5c2a8831d447987c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
