Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d1e1ada1 by Moritz Mühlenhoff at 2021-08-10T13:28:01+02:00
NFUs
new gitlab issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -107,7 +107,7 @@ CVE-2021-38313
CVE-2021-38312
RESERVED
CVE-2021-38311 (In Contiki 3.0, potential nonterminating acknowledgment loops
exist in ...)
- TODO: check
+ NOT-FOR-US: Contiki
CVE-2021-38310
RESERVED
CVE-2021-38309
@@ -119,7 +119,7 @@ CVE-2021-38307
CVE-2021-38306
RESERVED
CVE-2021-38305 (23andMe Yamale before 3.0.8 allows remote attackers to execute
arbitra ...)
- TODO: check
+ NOT-FOR-US: 23andMe Yamale
CVE-2021-38304
RESERVED
CVE-2021-38303
@@ -1230,7 +1230,6 @@ CVE-2021-3673 (A vulnerability was found in Radare2 in
version 5.3.1. Improper i
- radare2 <unfixed>
NOTE: https://github.com/radareorg/radare2/issues/18923
NOTE:
https://github.com/radareorg/radare2/commit/d7ea20fb2e1433ebece9f004d87ad8f2377af23d
- TODO: check details
CVE-2021-37838
RESERVED
CVE-2021-37837
@@ -1668,9 +1667,9 @@ CVE-2021-37636
CVE-2021-37635
RESERVED
CVE-2021-37634 (Leafkit is a templating language with Swift-inspired syntax.
Versions ...)
- TODO: check
+ NOT-FOR-US: Leafkit
CVE-2021-37633 (Discourse is an open source discussion platform. In versions
prior to ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2021-37632 (SuperMartijn642's Config Lib is a library used by a number of
mods for ...)
NOT-FOR-US: SuperMartijn642's Config Lib (lib for Minecraft)
CVE-2021-37631
@@ -1822,7 +1821,7 @@ CVE-2021-37575
CVE-2021-37574
RESERVED
CVE-2021-37573 (A reflected cross-site scripting (XSS) vulnerability in the
web server ...)
- TODO: check
+ NOT-FOR-US: TTiny Java Web Server and Servlet Container (TJWS)
CVE-2021-37572
RESERVED
CVE-2021-37571
@@ -2585,15 +2584,15 @@ CVE-2021-3658
CVE-2021-37216 (QSAN Storage Manager header page parameters does not filter
special ch ...)
NOT-FOR-US: QSAN Storage Manager
CVE-2021-37215 (The employee management page of Flygo contains an Insecure
Direct Obje ...)
- TODO: check
+ NOT-FOR-US: Flygo
CVE-2021-37214 (The employee management page of Flygo contains Insecure Direct
Object ...)
- TODO: check
+ NOT-FOR-US: Flygo
CVE-2021-37213 (The check-in record page of Flygo contains Insecure Direct
Object Refe ...)
- TODO: check
+ NOT-FOR-US: Flygo
CVE-2021-37212 (The bulletin function of Flygo contains Insecure Direct Object
Referen ...)
- TODO: check
+ NOT-FOR-US: Flygo
CVE-2021-37211 (The bulletin function of Flygo does not filter special
characters whil ...)
- TODO: check
+ NOT-FOR-US: Flygo
CVE-2021-37210
RESERVED
CVE-2021-37209
@@ -3498,13 +3497,13 @@ CVE-2021-36800 (Akaunting version 2.1.12 and earlier
suffers from a code injecti
CVE-2021-36799 (KNX ETS5 uses the hard-coded password ETS5Password, with a
salt value ...)
NOT-FOR-US: KNX ETS5
CVE-2021-36798 (A Denial-of-Service (DoS) vulnerability was discovered in Team
Server ...)
- TODO: check
+ NOT-FOR-US: HelpSystems Cobalt Strike
CVE-2021-36797 (** DISPUTED ** In Victron Energy Venus OS through 2.72, root
access is ...)
NOT-FOR-US: Victron Energy Venus OS
CVE-2021-36796
RESERVED
CVE-2021-36795 (A permission issue in the Cohesity Linux agent may allow
privilege esc ...)
- TODO: check
+ NOT-FOR-US: Cohesity
CVE-2021-36794
RESERVED
CVE-2021-36793
@@ -4678,9 +4677,9 @@ CVE-2021-36279
CVE-2021-36278
RESERVED
CVE-2021-36277 (Dell Command Update, Dell Update, and Alienware Update
versions prior ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2021-36276 (Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an
insuffic ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2021-36275
RESERVED
CVE-2021-36274
@@ -4947,9 +4946,9 @@ CVE-2021-36159 (libfetch before 2021-07-26, as used in
apk-tools, xbps, and othe
CVE-2021-36158 (In the xrdp package (in branches through 3.14) for Alpine
Linux, RDP s ...)
- xrdp <not-affected> (xrdp as packaged in Alpine)
CVE-2021-36157 (An issue was discovered in Grafana Cortex through 1.9.0. The
header va ...)
- TODO: check
+ NOT-FOR-US: Grafana Cortex
CVE-2021-36156 (An issue was discovered in Grafana Loki through 2.2.1. The
header valu ...)
- TODO: check
+ NOT-FOR-US: Grafana Loki
CVE-2021-36155 (LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier
allocates ...)
NOT-FOR-US: gRPC Swift
CVE-2021-36154 (HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier
allows remot ...)
@@ -8399,9 +8398,9 @@ CVE-2021-34663
CVE-2021-34662
RESERVED
CVE-2021-34661 (The WP Fusion Lite WordPress plugin is vulnerable to
Cross-Site Reques ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-34660 (The WP Fusion Lite WordPress plugin is vulnerable to Reflected
Cross-S ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-34659
RESERVED
CVE-2021-34658
@@ -11626,7 +11625,7 @@ CVE-2021-33258
CVE-2021-33257
RESERVED
CVE-2021-33256 (A CSV injection vulnerability on the login panel of
ManageEngine ADSel ...)
- TODO: check
+ NOT-FOR-US: ManageEngine
CVE-2021-33255
RESERVED
CVE-2021-33254
@@ -19975,7 +19974,7 @@ CVE-2021-29980
CVE-2021-29979 (Hubs Cloud allows users to download shared content,
specifically HTML ...)
NOT-FOR-US: Hubs Cloud
CVE-2021-29978 (Multiple low security issues were discovered and fixed in a
security a ...)
- TODO: check
+ NOT-FOR-US: Mozilla VPN
CVE-2021-29977 (Mozilla developers reported memory safety bugs present in
Firefox 89. ...)
- firefox 90.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-28/#CVE-2021-29977
@@ -20622,7 +20621,7 @@ CVE-2021-29716
CVE-2021-29715
RESERVED
CVE-2021-29714 (IBM Content Navigator 3.0.CD could allow a malicious user to
cause a d ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2021-29713
RESERVED
CVE-2021-29712 (IBM InfoSphere Information Server 11.7 is vulnerable to
cross-site scr ...)
@@ -28381,7 +28380,7 @@ CVE-2021-3353
CVE-2021-3352
RESERVED
CVE-2021-3351 (OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the
Device ...)
- TODO: check
+ NOT-FOR-US: OpenPLC
CVE-2021-3350 (deleteaccount.php in the Delete Account plugin 1.4 for MyBB
allows XSS ...)
NOT-FOR-US: Delete Account plugin for MyBB
CVE-2021-3349 (** DISPUTED ** GNOME Evolution through 3.38.3 produces a "Valid
signat ...)
@@ -33279,11 +33278,11 @@ CVE-2021-24524
CVE-2021-24523
RESERVED
CVE-2021-24522 (The User Registration, User Profile, Login & Membership
– Pr ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24521 (The Side Menu Lite – add sticky fixed buttons WordPress
plugin b ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24520 (The Stock in & out WordPress plugin through 1.0.4 lacks
proper san ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24519
RESERVED
CVE-2021-24518
@@ -33305,27 +33304,27 @@ CVE-2021-24511
CVE-2021-24510
RESERVED
CVE-2021-24509 (The Page View Count WordPress plugin before 2.4.9 does not
escape the ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24508
RESERVED
CVE-2021-24507 (The Astra Pro Addon WordPress plugin before 3.5.2 did not
properly san ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24506
RESERVED
CVE-2021-24505 (The Forms WordPress plugin before 1.12.3 did not sanitise its
input fi ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24504 (The WP LMS – Best WordPress LMS Plugin WordPress plugin
through ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24503 (The Popular Brand Icons – Simple Icons WordPress plugin
before 2 ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24502 (The WP Google Map WordPress plugin before 1.7.7 did not
sanitise or es ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24501 (The Workreap WordPress theme before 2.2.2 had several AJAX
actions mis ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2021-24500 (Several AJAX actions available in the Workreap WordPress theme
before ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2021-24499 (The Workreap WordPress theme before 2.2.2 AJAX actions
workreap_award_ ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2021-24498 (The Calendar Event Multi View WordPress plugin before 1.4.01
does not ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24497
@@ -33333,7 +33332,7 @@ CVE-2021-24497
CVE-2021-24496 (The Community Events WordPress plugin before 1.4.8 does not
sanitise, ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24495 (The Marmoset Viewer WordPress plugin before 1.9.3 does not
property sa ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24494 (The WP Offload SES Lite WordPress plugin before 1.4.5 did not
escape s ...)
NOT-FOR-US: Wordpress plugin
CVE-2021-24493
@@ -33389,7 +33388,7 @@ CVE-2021-24469
CVE-2021-24468 (The Leaflet Map WordPress plugin before 3.0.0 does not escape
some sho ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24467 (The Leaflet Map WordPress plugin before 3.0.0 does not verify
the CSRF ...)
- TODO: check
+ NOT-FOR-US: Wordpress plugin
CVE-2021-24466
RESERVED
CVE-2021-24465
@@ -33715,7 +33714,7 @@ CVE-2021-24306 (The Ultimate Member – User
Profile, User Registration, Log
CVE-2021-24305 (The Target First WordPress Plugin v2.0, also previously known
as Watch ...)
NOT-FOR-US: WordPress plugin
CVE-2021-24304 (The Newsmag WordPress theme before 5.0 does not sanitise the
td_block_ ...)
- TODO: check
+ NOT-FOR-US: Wordpress theme
CVE-2021-24303
RESERVED
CVE-2021-24302 (The Hana Flv Player WordPress plugin through 3.1.3 is
vulnerable to an ...)
@@ -36885,7 +36884,7 @@ CVE-2021-22912 (Nextcloud iOS before 3.4.2 suffers from
an information disclosur
CVE-2021-22911 (A improper input sanitization vulnerability exists in
Rocket.Chat serv ...)
NOT-FOR-US: Rocket.Chat
CVE-2021-22910 (A sanitization vulnerability exists in Rocket.Chat server
versions < ...)
- TODO: check
+ NOT-FOR-US: Rocket.Chat
CVE-2021-22909 (A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier
could a ...)
NOT-FOR-US: EdgeMAX EdgeRouter
CVE-2021-22908 (A buffer overflow vulnerability exists in Windows File
Resource Profil ...)
@@ -38447,9 +38446,9 @@ CVE-2021-22243
CVE-2021-22242
RESERVED
CVE-2021-22241 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2021-22240 (Improper access control in GitLab EE versions 13.11.6,
13.12.6, and 14 ...)
- TODO: check
+ - gitlab <not-affected> (Specific to EE)
CVE-2021-22239
RESERVED
- gitlab <unfixed>
@@ -38473,7 +38472,7 @@ CVE-2021-22235 (Crash in DNP dissector in Wireshark
3.4.0 to 3.4.6 and 3.2.0 to
NOTE: https://www.wireshark.org/security/wnpa-sec-2021-06.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/17462
CVE-2021-22234 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2021-22233 (An information disclosure vulnerability in GitLab EE versions
13.10 an ...)
- gitlab <not-affected> (Specific to EE)
CVE-2021-22232 (HTML injection was possible via the full name field before
versions 13 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d1e1ada188b85717f69be2be11fdac7d3599bfd3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d1e1ada188b85717f69be2be11fdac7d3599bfd3
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
