Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
32b9bf0e by security tracker role at 2021-10-07T20:10:49+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,55 @@
+CVE-2021-42083
+ RESERVED
+CVE-2021-42082
+ RESERVED
+CVE-2021-42081
+ RESERVED
+CVE-2021-42080
+ RESERVED
+CVE-2021-42079
+ RESERVED
+CVE-2021-42078
+ RESERVED
+CVE-2021-42077
+ RESERVED
+CVE-2021-42076
+ RESERVED
+CVE-2021-42075
+ RESERVED
+CVE-2021-42074
+ RESERVED
+CVE-2021-42073
+ RESERVED
+CVE-2021-42072
+ RESERVED
+CVE-2021-42071 (In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker
can ach ...)
+ TODO: check
+CVE-2021-42070
+ RESERVED
+CVE-2021-42069
+ RESERVED
+CVE-2021-42068
+ RESERVED
+CVE-2021-42067
+ RESERVED
+CVE-2021-42066
+ RESERVED
+CVE-2021-42065
+ RESERVED
+CVE-2021-42064
+ RESERVED
+CVE-2021-42063
+ RESERVED
+CVE-2021-42062
+ RESERVED
+CVE-2021-42061
+ RESERVED
+CVE-2021-3868
+ RESERVED
+CVE-2021-3867
+ RESERVED
+CVE-2021-3866
+ RESERVED
CVE-2021-42060
RESERVED
CVE-2021-42059
@@ -114,8 +166,7 @@ CVE-2021-42015
RESERVED
CVE-2021-42014
RESERVED
-CVE-2021-42013
- RESERVED
+CVE-2021-42013 (It was found that the fix for CVE-2021-41773 in Apache HTTP
Server 2.4 ...)
- apache2 <unfixed>
[bullseye] - apache2 <not-affected> (Vulnerable code not present, only
affects 2.4.49/2.4.50)
[buster] - apache2 <not-affected> (Vulnerable code not present, only
affects 2.4.49/2.4.50)
@@ -451,8 +502,8 @@ CVE-2021-3853
RESERVED
CVE-2021-3852
RESERVED
-CVE-2021-41865
- RESERVED
+CVE-2021-41865 (HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5
allowed authe ...)
+ TODO: check
CVE-2021-41864 (prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the
Linux kern ...)
- linux <unfixed>
NOTE:
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
@@ -628,8 +679,8 @@ CVE-2021-41796
RESERVED
CVE-2021-41795 (The Safari app extension bundled with 1Password for Mac 7.7.0
through ...)
NOT-FOR-US: 1Password
-CVE-2021-41794
- RESERVED
+CVE-2021-41794 (ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately
trusts a ...)
+ TODO: check
CVE-2021-41793
RESERVED
CVE-2021-41792
@@ -706,12 +757,12 @@ CVE-2021-3836
RESERVED
CVE-2021-3835
RESERVED
-CVE-2021-3834
- RESERVED
-CVE-2021-3833
- RESERVED
-CVE-2021-3832
- RESERVED
+CVE-2021-3834 (Integria IMS in its 5.0.92 version does not filter correctly
some fiel ...)
+ TODO: check
+CVE-2021-3833 (Integria IMS login check uses a loose comparator ("==") to
compare the ...)
+ TODO: check
+CVE-2021-3832 (Integria IMS in its 5.0.92 version is vulnerable to a Remote
Code Exec ...)
+ TODO: check
CVE-2021-3831
RESERVED
CVE-2021-41765
@@ -2426,8 +2477,8 @@ CVE-2021-40980
RESERVED
CVE-2021-40979
RESERVED
-CVE-2021-40978
- RESERVED
+CVE-2021-40978 (The mkdocs 1.2.2 built-in dev-server allows directory
traversal using ...)
+ TODO: check
CVE-2021-40977
RESERVED
CVE-2021-40976
@@ -3022,10 +3073,10 @@ CVE-2021-40728
RESERVED
CVE-2021-40727
RESERVED
-CVE-2021-40726
- RESERVED
-CVE-2021-40725
- RESERVED
+CVE-2021-40726 (Acrobat Reader DC versions 2021.005.20060 (and earlier),
2020.004.3000 ...)
+ TODO: check
+CVE-2021-40725 (Acrobat Reader DC versions 2021.005.20060 (and earlier),
2020.004.3000 ...)
+ TODO: check
CVE-2021-40724
RESERVED
CVE-2021-40723
@@ -3700,8 +3751,8 @@ CVE-2021-3763
CVE-2021-3762
RESERVED
NOT-FOR-US: Quay/clair
-CVE-2021-40439
- RESERVED
+CVE-2021-40439 (Apache OpenOffice has a dependency on expat software. Versions
prior t ...)
+ TODO: check
CVE-2021-40438 (A crafted request uri-path can cause mod_proxy to forward the
request ...)
{DLA-2776-1}
- apache2 2.4.49-1
@@ -9727,34 +9778,34 @@ CVE-2021-3679 (A lack of CPU resource in the Linux
kernel tracing module functio
NOTE:
https://git.kernel.org/linus/67f0d6d9883c13174669f88adac4f0ee656cc16a
CVE-2021-3678 (showdoc is vulnerable to Use of Cryptographically Weak
Pseudo-Random N ...)
NOT-FOR-US: showdoc
-CVE-2021-37931
- RESERVED
-CVE-2021-37930
- RESERVED
-CVE-2021-37929
- RESERVED
-CVE-2021-37928
- RESERVED
+CVE-2021-37931 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37930 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37929 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37928 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
CVE-2021-37927 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
account ...)
NOT-FOR-US: Zoho ManageEngine ADManager Plus
-CVE-2021-37926
- RESERVED
+CVE-2021-37926 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
CVE-2021-37925 (Zoho ManageEngine ADManager Plus version 7110 and prior has a
Post-Aut ...)
NOT-FOR-US: Zoho ManageEngine ADManager Plus
-CVE-2021-37924
- RESERVED
-CVE-2021-37923
- RESERVED
-CVE-2021-37922
- RESERVED
-CVE-2021-37921
- RESERVED
-CVE-2021-37920
- RESERVED
-CVE-2021-37919
- RESERVED
-CVE-2021-37918
- RESERVED
+CVE-2021-37924 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37923 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37922 (Zoho ManageEngine ADManager Plus version 7110 and prior is
vulnerable ...)
+ TODO: check
+CVE-2021-37921 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37920 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37919 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
+CVE-2021-37918 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
CVE-2021-37917
RESERVED
CVE-2021-37916 (Joplin before 2.0.9 allows XSS via button and form in the note
body. ...)
@@ -10094,8 +10145,8 @@ CVE-2021-37764
RESERVED
CVE-2021-37763
RESERVED
-CVE-2021-37762
- RESERVED
+CVE-2021-37762 (Zoho ManageEngine ADManager Plus version 7110 and prior allows
unrestr ...)
+ TODO: check
CVE-2021-37761 (Zoho ManageEngine ADManager Plus version 7110 and prior is
vulnerable ...)
NOT-FOR-US: Zoho ManageEngine
CVE-2021-37760 (A Session ID leak in the audit log in Graylog before 4.1.2
allows atta ...)
@@ -13748,8 +13799,8 @@ CVE-2021-3634 (A flaw has been found in libssh in
versions prior to 0.9.6. The S
NOTE: https://www.libssh.org/security/advisories/CVE-2021-3634.txt
NOTE: https://www.libssh.org/2021/08/26/libssh-0-9-6-security-release/
NOTE: Fixed by:
https://git.libssh.org/projects/libssh.git/commit/?id=d3060bc84ed4e160082e819b4d404f76df7c8063
(libssh-0.9.6)
-CVE-2021-36150
- RESERVED
+CVE-2021-36150 (SilverStripe Framework through 4.8.1 allows XSS. ...)
+ TODO: check
CVE-2021-36149
RESERVED
CVE-2021-36148 (An issue was discovered in ACRN before 2.5. dmar_free_irte in
hypervis ...)
@@ -16299,8 +16350,8 @@ CVE-2021-35069
RESERVED
CVE-2021-35068
RESERVED
-CVE-2021-35067
- RESERVED
+CVE-2021-35067 (Meross MSG100 devices before 3.2.3 allow an attacker to replay
the sam ...)
+ TODO: check
CVE-2021-3612 (An out-of-bounds memory write flaw was found in the Linux
kernel's joy ...)
- linux 5.10.46-3
NOTE: Introduced by:
https://lore.kernel.org/linux-input/20210219083215.GS2087@kadam/
@@ -18960,8 +19011,8 @@ CVE-2021-33905
RESERVED
CVE-2021-33904 (** DISPUTED ** In Accela Civic Platform through 21.1, the
security/hos ...)
NOT-FOR-US: Accela Civic Platform
-CVE-2021-33903
- RESERVED
+CVE-2021-33903 (In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM
devices, ...)
+ TODO: check
CVE-2021-33902
RESERVED
CVE-2021-33901
@@ -23267,8 +23318,8 @@ CVE-2021-32174
RESERVED
CVE-2021-32173
RESERVED
-CVE-2021-32172
- RESERVED
+CVE-2021-32172 (Maian Cart v3.8 contains a preauthorization remote code
execution (RCE ...)
+ TODO: check
CVE-2021-32171
RESERVED
CVE-2021-32170
@@ -29865,8 +29916,8 @@ CVE-2021-29702 (Db2 for Linux, UNIX and Windows
(includes Db2 Connect Server) 11
NOT-FOR-US: IBM
CVE-2021-29701
RESERVED
-CVE-2021-29700
- RESERVED
+CVE-2021-29700 (IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through
6.1.1.0 c ...)
+ TODO: check
CVE-2021-29699 (IBM Security Verify Access Docker 10.0.0 could allow a remote
priviled ...)
NOT-FOR-US: IBM
CVE-2021-29698
@@ -32501,8 +32552,8 @@ CVE-2021-28662 (An issue was discovered in Squid 4.x
before 4.15 and 5.x before
- squid 4.13-10 (bug #988891)
NOTE:
https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h
NOTE:
http://www.squid-cache.org/Versions/v4/changesets/squid-4-b1c37c9e7b30d0efb5e5ccf8200f2a646b9c36f8.patch
-CVE-2021-28661
- RESERVED
+CVE-2021-28661 (Default SilverStripe GraphQL Server (aka silverstripe/graphql)
3.x thr ...)
+ TODO: check
CVE-2021-3449 (An OpenSSL TLS server may crash if sent a maliciously crafted
renegoti ...)
{DSA-4875-1}
- openssl 1.1.1k-1
@@ -33797,8 +33848,8 @@ CVE-2021-28131 (Impala sessions use a 16 byte secret to
verify that the session
NOT-FOR-US: Apache Impala
CVE-2021-28130 (Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts
applicati ...)
NOT-FOR-US: Dr.Web Firewall
-CVE-2021-28129
- RESERVED
+CVE-2021-28129 (While working on Apache OpenOffice 4.1.8 a developer
discovered that t ...)
+ TODO: check
CVE-2021-28128 (In Strapi through 3.6.0, the admin panel allows the changing
of one's ...)
NOT-FOR-US: Strapi
CVE-2021-28127 (An issue was discovered in Stormshield SNS through 4.2.1. A
brute-forc ...)
@@ -44996,8 +45047,8 @@ CVE-2021-23449
RESERVED
CVE-2021-23448
RESERVED
-CVE-2021-23447
- RESERVED
+CVE-2021-23447 (This affects the package teddy before 0.5.9. A type confusion
vulnerab ...)
+ TODO: check
CVE-2021-23446 (The package handsontable before 10.0.0; the package
handsontable from ...)
NOT-FOR-US: Node handsontable
CVE-2021-23445 (This affects the package datatables.net before 1.11.3. If an
array is ...)
@@ -46048,8 +46099,8 @@ CVE-2021-22960
RESERVED
CVE-2021-22959
RESERVED
-CVE-2021-22958
- RESERVED
+CVE-2021-22958 (A Server-Side Request Forgery vulnerability was found in
concrete5 < ...)
+ TODO: check
CVE-2021-22957
RESERVED
CVE-2021-22956
@@ -46127,8 +46178,7 @@ CVE-2021-22932 (An issue has been identified in the
CTX269106 mitigation tool fo
CVE-2021-22931 (Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to
Remote Co ...)
- nodejs <not-affected> (Debian builds nodejs against src:c-ares)
NOTE:
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#cares-upgrade-improper-handling-of-untypical-characters-in-domain-names-high-cve-2021-22931
-CVE-2021-22930 [Use after free on close http2 on stream canceling]
- RESERVED
+CVE-2021-22930 (Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a
use aft ...)
- nodejs 12.22.4~dfsg-1
[bullseye] - nodejs 12.22.5~dfsg-2~11u1
[stretch] - nodejs <end-of-life> (Nodejs in stretch not covered by
security support)
@@ -53264,14 +53314,14 @@ CVE-2021-20607
RESERVED
CVE-2021-20606
RESERVED
-CVE-2021-20605
- RESERVED
-CVE-2021-20604
- RESERVED
-CVE-2021-20603
- RESERVED
-CVE-2021-20602
- RESERVED
+CVE-2021-20605 (Improper Input Validation vulnerability in GOT2000 series GT21
model G ...)
+ TODO: check
+CVE-2021-20604 (Improper Input Validation vulnerability in GOT2000 series GT21
model G ...)
+ TODO: check
+CVE-2021-20603 (Improper Input Validation vulnerability in GOT2000 series GT21
model G ...)
+ TODO: check
+CVE-2021-20602 (Improper Handling of Exceptional Conditions vulnerability in
GOT2000 s ...)
+ TODO: check
CVE-2021-20601
RESERVED
CVE-2021-20600
@@ -53306,8 +53356,8 @@ CVE-2021-20586 (Resource management errors
vulnerability in a robot controller o
NOT-FOR-US: Mitsubishi
CVE-2021-20585 (IBM Security Verify Access 20.07 could disclose sensitive
information ...)
NOT-FOR-US: IBM
-CVE-2021-20584
- RESERVED
+CVE-2021-20584 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow
a remote ...)
+ TODO: check
CVE-2021-20583 (IBM Security Verify (IBM Security Verify Privilege Vault
10.9.66) coul ...)
NOT-FOR-US: IBM
CVE-2021-20582 (IBM Security Secret Server up to 11.0 stores sensitive
information in ...)
@@ -53332,8 +53382,8 @@ CVE-2021-20573 (IBM Security Identity Manager Adapters
6.0 and 7.0 are vulnerabl
NOT-FOR-US: IBM
CVE-2021-20572 (IBM Security Identity Manager Adapters 6.0 and 7.0 are
vulnerable to a ...)
NOT-FOR-US: IBM
-CVE-2021-20571
- RESERVED
+CVE-2021-20571 (IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is
vulnerable to s ...)
+ TODO: check
CVE-2021-20570
RESERVED
CVE-2021-20569 (IBM Security Secret Server up to 11.0 could allow an attacker
to enume ...)
@@ -53352,8 +53402,8 @@ CVE-2021-20563 (IBM Sterling File Gateway 2.2.0.0
through 6.1.0.3 could allow a
NOT-FOR-US: IBM
CVE-2021-20562 (IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through
5.2.6.5_3 ...)
NOT-FOR-US: IBM
-CVE-2021-20561
- RESERVED
+CVE-2021-20561 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is
vulnerable to cro ...)
+ TODO: check
CVE-2021-20560 (IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and
1.5.0.2 ...)
NOT-FOR-US: IBM
CVE-2021-20559 (IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to
cross-site scrip ...)
@@ -53370,8 +53420,8 @@ CVE-2021-20554 (IBM Sterling Order Management 9.4, 9.5,
and 10.0 is vulnerable t
NOT-FOR-US: IBM
CVE-2021-20553
RESERVED
-CVE-2021-20552
- RESERVED
+CVE-2021-20552 (IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow
a remote ...)
+ TODO: check
CVE-2021-20551
RESERVED
CVE-2021-20550 (IBM Content Navigator 3.0.CD is vulnerable to cross-site
scripting. Th ...)
@@ -53496,8 +53546,8 @@ CVE-2021-20491 (IBM Spectrum Protect Server 7.1 and 8.1
is subject to a stack-ba
NOT-FOR-US: IBM
CVE-2021-20490 (IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a
local us ...)
NOT-FOR-US: IBM
-CVE-2021-20489
- RESERVED
+CVE-2021-20489 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is
vulnerable to cro ...)
+ TODO: check
CVE-2021-20488 (IBM Security Identity Manager 6.0.2 could allow an
authenticated malic ...)
NOT-FOR-US: IBM
CVE-2021-20487 (IBM Power9 Self Boot Engine(SBE) could allow a privileged user
to inje ...)
@@ -53512,8 +53562,8 @@ CVE-2021-20483 (IBM Security Identity Manager 6.0.2 is
vulnerable to server-side
NOT-FOR-US: IBM
CVE-2021-20482 (IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are
vulnerable to ...)
NOT-FOR-US: IBM
-CVE-2021-20481
- RESERVED
+CVE-2021-20481 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is
vulnerable to cro ...)
+ TODO: check
CVE-2021-20480 (IBM WebSphere Application Server 7.0, 8.0, and 8.5 is
vulnerable to se ...)
NOT-FOR-US: IBM
CVE-2021-20479
@@ -53528,8 +53578,8 @@ CVE-2021-20475
RESERVED
CVE-2021-20474 (IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does
not perfor ...)
NOT-FOR-US: IBM
-CVE-2021-20473
- RESERVED
+CVE-2021-20473 (IBM Sterling File Gateway User Interface 2.2.0.0 through
6.1.1.0 does ...)
+ TODO: check
CVE-2021-20472
RESERVED
CVE-2021-20471
@@ -53722,16 +53772,16 @@ CVE-2021-20378 (IBM Guardium Data Encryption (GDE)
3.0.0.2 and 4.0.0.4 does not
NOT-FOR-US: IBM
CVE-2021-20377 (IBM Security Guardium 11.3 could allow a remote attacker to
obtain sen ...)
NOT-FOR-US: IBM
-CVE-2021-20376
- RESERVED
-CVE-2021-20375
- RESERVED
+CVE-2021-20376 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow
an authe ...)
+ TODO: check
+CVE-2021-20375 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow
an authe ...)
+ TODO: check
CVE-2021-20374 (IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to
stored cr ...)
NOT-FOR-US: IBM
CVE-2021-20373
RESERVED
-CVE-2021-20372
- RESERVED
+CVE-2021-20372 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow
a remote ...)
+ TODO: check
CVE-2021-20371 (IBM Jazz Foundation and IBM Engineering products could allow a
remote ...)
NOT-FOR-US: IBM
CVE-2021-20370
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32b9bf0eddf407a4c2922151595f8bd46c763591
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32b9bf0eddf407a4c2922151595f8bd46c763591
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
