Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0e7b5df8 by Moritz Muehlenhoff at 2021-07-02T23:31:11+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,21 +3,21 @@ CVE-2021-36134
CVE-2021-36133
RESERVED
CVE-2021-36132 (An issue was discovered in the FileImporter extension in
MediaWiki thr ...)
- TODO: check
+ NOT-FOR-US: FileImport MediaWiki extension
CVE-2021-36131 (An XSS issue was discovered in the SportsTeams extension in
MediaWiki ...)
- TODO: check
+ NOT-FOR-US: SportsTeams MediaWiki extension
CVE-2021-36130 (An XSS issue was discovered in the SocialProfile extension in
MediaWik ...)
- TODO: check
+ NOT-FOR-US: SocialProfile MediaWiki extension
CVE-2021-36129 (An issue was discovered in the Translate extension in
MediaWiki throug ...)
- TODO: check
+ NOT-FOR-US: Translate MediaWiki extension
CVE-2021-36128 (An issue was discovered in the CentralAuth extension in
MediaWiki thro ...)
- TODO: check
+ NOT-FOR-US: CentralAuth MediaWiki extension
CVE-2021-36127 (An issue was discovered in the CentralAuth extension in
MediaWiki thro ...)
- TODO: check
+ NOT-FOR-US: CentralAuth MediaWiki extension
CVE-2021-36126 (An issue was discovered in the AbuseFilter extension in
MediaWiki thro ...)
- TODO: check
+ NOT-FOR-US: AbuseFilter MediaWiki extension
CVE-2021-36125 (An issue was discovered in the CentralAuth extension in
MediaWiki thro ...)
- TODO: check
+ NOT-FOR-US: CentralAuth MediaWiki extension
CVE-2021-36124
RESERVED
CVE-2021-36123
@@ -94,23 +94,23 @@ CVE-2021-3632
CVE-2021-36090
RESERVED
CVE-2020-36416 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36415 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36414 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36413 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36412 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36411 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36410 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36409 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2020-36408 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2021-36089 (Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in
grk::File ...)
- libgrokj2k <unfixed> (bug #990525)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33544
@@ -187,15 +187,15 @@ CVE-2020-36400 (ZeroMQ libzmq 4.3.3 has a heap-based
buffer overflow in zmq::tcp
NOTE: Introduced by:
https://github.com/zeromq/libzmq/commit/b56195e995e0875afabf405826d97b1dd9817bb0
(v4.3.3)
NOTE: Fixed by:
https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306
(v4.3.3)
CVE-2020-36399 (A stored cross site scripting (XSS) vulnerability in phplist
3.5.4 and ...)
- TODO: check
+ - phplist <itp> (bug #612288)
CVE-2020-36398 (A stored cross site scripting (XSS) vulnerability in phplist
3.5.4 and ...)
- TODO: check
+ - phplist <itp> (bug #612288)
CVE-2020-36397 (A stored cross site scripting (XSS) vulnerability in the
/admin/contac ...)
- TODO: check
+ NOT-FOR-US: LavaLite
CVE-2020-36396 (A stored cross site scripting (XSS) vulnerability in the
/admin/roles/ ...)
- TODO: check
+ NOT-FOR-US: LavaLite
CVE-2020-36395 (A stored cross site scripting (XSS) vulnerability in the
/admin/user/t ...)
- TODO: check
+ NOT-FOR-US: LavaLite
CVE-2019-25049 (LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in
asn1_item_pr ...)
- libressl <itp> (bug #754513)
CVE-2019-25048 (LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read
in do_p ...)
@@ -2037,15 +2037,15 @@ CVE-2020-36394 (pam_setquota.c in the pam_setquota
module before 2020-05-29 for
NOTE: https://www.openwall.com/lists/oss-security/2020/06/04/5
NOTE:
https://github.com/linux-pam/linux-pam/commit/27ded8954a1235bb65ffc9c730ae5a50b1dfed61
CVE-2021-3613 (OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load
arbitra ...)
- TODO: check
+ NOT-FOR-US: OpenVPN Connect
CVE-2021-35210 (Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through
4.11.x be ...)
NOT-FOR-US: Contao CMS
CVE-2021-35209 (An issue was discovered in ProxyServlet.java in the /proxy
servlet in ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2021-35208 (An issue was discovered in ZmMailMsgView.js in the Calendar
Invite com ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2021-35207 (An issue was discovered in Zimbra Collaboration Suite 8.8
before 8.8.1 ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2021-35206 (Gitpod before 0.6.0 allows unvalidated redirects. ...)
NOT-FOR-US: Gitpod
CVE-2021-35205
@@ -2446,7 +2446,7 @@ CVE-2021-35031
CVE-2021-35030
RESERVED
CVE-2021-35029 (An authentication bypasss vulnerability in the web-based
management in ...)
- TODO: check
+ NOT-FOR-US: Zyxel
CVE-2021-35028
RESERVED
CVE-2021-35027
@@ -2862,7 +2862,7 @@ CVE-2021-3607 [pvrdma: unchecked malloc size due to
integer overflow in init_dev
[stretch] - qemu <not-affected> (Vulnerable code introduced later)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1973349
CVE-2021-3606 (OpenVPN before version 2.5.3 on Windows allows local users to
load arb ...)
- TODO: check
+ - openvpn <not-affected> (Windows-specific)
CVE-2021-34826
RESERVED
CVE-2021-34825 (Quassel through 0.13.1, when --require-ssl is enabled,
launches withou ...)
@@ -2918,7 +2918,7 @@ CVE-2021-34809 (Improper neutralization of special
elements used in a command ('
CVE-2021-34808 (Server-Side Request Forgery (SSRF) vulnerability in cgi
component in S ...)
NOT-FOR-US: Synology
CVE-2021-34807 (An open redirect vulnerability exists in the /preauth Servlet
in Zimbr ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2021-34806
RESERVED
CVE-2021-34805
@@ -7611,11 +7611,11 @@ CVE-2021-32739
CVE-2021-32738 (js-stellar-sdk is a Javascript library for communicating with
a Stella ...)
TODO: check
CVE-2021-32737 (Sulu is an open-source PHP content management system based on
the Symf ...)
- TODO: check
+ NOT-FOR-US: Sulu
CVE-2021-32736 (think-helper defines a set of helper functions for ThinkJS. In
version ...)
NOT-FOR-US: think-helper
CVE-2021-32735 (Kirby is a content management system. In Kirby CMS versions
3.5.5 and ...)
- TODO: check
+ NOT-FOR-US: Kirby
CVE-2021-32734
RESERVED
CVE-2021-32733
@@ -7822,7 +7822,7 @@ CVE-2021-32640 (ws is an open source WebSocket client and
server library for Nod
NOTE:
https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
NOTE:
https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
CVE-2021-32639 (Emissary is a P2P-based, data-driven workflow engine. Emissary
version ...)
- TODO: check
+ NOT-FOR-US: NSA Emissary
CVE-2021-32638 (Github's CodeQL action is provided to run CodeQL-based code
scanning o ...)
NOT-FOR-US: Github
CVE-2021-32637 (Authelia is a a single sign-on multi-factor portal for web
apps. This ...)
@@ -9671,7 +9671,7 @@ CVE-2021-31876 (Bitcoin Core 0.12.0 through 0.21.1 does
not properly implement t
CVE-2021-31875 (In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously
formed JSO ...)
NOT-FOR-US: Cesanta MongooseOS mJS
CVE-2021-31874 (Zoho ManageEngine ADSelfService Plus before 6104, in rare
situations, ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2021-31873 (An issue was discovered in klibc before 2.0.9. Additions in
the malloc ...)
{DLA-2695-1}
- klibc 2.0.8-6 (bug #989505)
@@ -19384,7 +19384,7 @@ CVE-2021-27952
CVE-2021-27951
RESERVED
CVE-2021-27950 (A SQL injection vulnerability in azurWebEngine in Sita AzurCMS
through ...)
- TODO: check
+ NOT-FOR-US: Sita AzurCMS
CVE-2021-27949 (Cross-site Scripting vulnerability in MyBB before 1.8.26 via
Custom mo ...)
NOT-FOR-US: MyBB
CVE-2021-27948 (SQL Injection vulnerability in MyBB before 1.8.26 via User
Groups. (is ...)
@@ -20507,7 +20507,7 @@ CVE-2021-27457 (A vulnerability has been found in
multiple revisions of Emerson
CVE-2021-27456
RESERVED
CVE-2021-27455 (Delta Electronics DOPSoft Versions 4.0.10.17 and prior are
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Delta Electronics
CVE-2021-27454 (The software performs an operation at a privilege level higher
than th ...)
NOT-FOR-US: GE
CVE-2021-27453
@@ -20593,7 +20593,7 @@ CVE-2021-27414
CVE-2021-27413 (Omron CX-One Versions 4.60 and prior, including CX-Server
Versions 5.0 ...)
NOT-FOR-US: Omron CX-One
CVE-2021-27412 (Delta Electronics DOPSoft Versions 4.0.10.17 and prior are
vulnerable ...)
- TODO: check
+ NOT-FOR-US: Delta Electronics
CVE-2021-27411
RESERVED
CVE-2021-27410 (The affected product is vulnerable to an out-of-bounds write,
which ma ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0e7b5df8fb29853f889298deb31dbd1b28734cbc
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0e7b5df8fb29853f889298deb31dbd1b28734cbc
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
