Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1fb06411 by security tracker role at 2021-10-08T20:10:39+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,28 @@
-CVE-2021-41133 [Sandbox bypass via recent VFS-manipulating syscalls]
+CVE-2021-42109 (VITEC Exterity IPTV products through 2021-04-30 allow
privilege escala ...)
+ TODO: check
+CVE-2021-42108
+ RESERVED
+CVE-2021-42107
+ RESERVED
+CVE-2021-42106
+ RESERVED
+CVE-2021-42105
+ RESERVED
+CVE-2021-42104
+ RESERVED
+CVE-2021-42103
+ RESERVED
+CVE-2021-42102
+ RESERVED
+CVE-2021-42101
+ RESERVED
+CVE-2021-3872
+ RESERVED
+CVE-2021-3871
+ RESERVED
+CVE-2021-3870
+ RESERVED
+CVE-2021-41133 (Flatpak is a system for building, distributing, and running
sandboxed ...)
- flatpak <unfixed> (bug #995935)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
CVE-2021-42100
@@ -299,12 +323,12 @@ CVE-2021-41978
RESERVED
CVE-2021-41977
RESERVED
-CVE-2021-41976
- RESERVED
-CVE-2021-41975
- RESERVED
-CVE-2021-41974
- RESERVED
+CVE-2021-41976 (Tad Uploader edit book list function is vulnerable to
authorization by ...)
+ TODO: check
+CVE-2021-41975 (TadTools special page is vulnerable to authorization bypass,
thus remo ...)
+ TODO: check
+CVE-2021-41974 (Tad Book3 editing book page does not perform identity
verification. Re ...)
+ TODO: check
CVE-2021-3858
RESERVED
CVE-2021-3857
@@ -372,8 +396,8 @@ CVE-2021-41949
RESERVED
CVE-2021-41948
RESERVED
-CVE-2021-41947
- RESERVED
+CVE-2021-41947 (A SQL injection vulnerability exists in Subrion CMS v4.2.1 in
the visu ...)
+ TODO: check
CVE-2021-41946
RESERVED
CVE-2021-41945
@@ -426,16 +450,16 @@ CVE-2021-41922
RESERVED
CVE-2021-41921
RESERVED
-CVE-2021-41920
- RESERVED
-CVE-2021-41919
- RESERVED
-CVE-2021-41918
- RESERVED
-CVE-2021-41917
- RESERVED
-CVE-2021-41916
- RESERVED
+CVE-2021-41920 (webTareas version 2.4 and earlier allows an unauthenticated
user to pe ...)
+ TODO: check
+CVE-2021-41919 (webTareas version 2.4 and earlier allows an authenticated user
to arbi ...)
+ TODO: check
+CVE-2021-41918 (webTareas version 2.4 and earlier allows an authenticated user
to inje ...)
+ TODO: check
+CVE-2021-41917 (webTareas version 2.4 and earlier allows an authenticated user
to stor ...)
+ TODO: check
+CVE-2021-41916 (A Cross-Site Request Forgery (CSRF) vulnerability in webTareas
version ...)
+ TODO: check
CVE-2021-41915
RESERVED
CVE-2021-41914
@@ -641,8 +665,8 @@ CVE-2021-41827 (Zoho ManageEngine Remote Access Plus before
10.1.2121.1 has hard
NOT-FOR-US: Zoho ManageEngine
CVE-2021-41826 (PlaceOS Authentication Service before 1.29.10.0 allows
app/controllers ...)
NOT-FOR-US: PlaceOS Authentication Service
-CVE-2021-41825
- RESERVED
+CVE-2021-41825 (Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML
injection ...)
+ TODO: check
CVE-2021-41824 (Craft CMS before 3.7.14 allows CSV injection. ...)
NOT-FOR-US: Craft CMS
CVE-2021-41823
@@ -687,8 +711,8 @@ CVE-2021-41804
RESERVED
CVE-2021-41803
RESERVED
-CVE-2021-41802
- RESERVED
+CVE-2021-41802 (HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3
allowed a ...)
+ TODO: check
CVE-2021-41801
RESERVED
{DSA-4979-1}
@@ -1231,18 +1255,18 @@ CVE-2021-41569
RESERVED
CVE-2021-3826
RESERVED
-CVE-2021-41568
- RESERVED
-CVE-2021-41567
- RESERVED
-CVE-2021-41566
- RESERVED
-CVE-2021-41565
- RESERVED
-CVE-2021-41564
- RESERVED
-CVE-2021-41563
- RESERVED
+CVE-2021-41568 (Tad Web is vulnerable to authorization bypass, thus remote
attackers c ...)
+ TODO: check
+CVE-2021-41567 (The new add subject parameter of Tad Uploader view book list
function ...)
+ TODO: check
+CVE-2021-41566 (The file extension of the TadTools file upload function fails
to filte ...)
+ TODO: check
+CVE-2021-41565 (TadTools special page parameter does not properly restrict the
input o ...)
+ TODO: check
+CVE-2021-41564 (Tad Honor viewing book list function is vulnerable to
authorization by ...)
+ TODO: check
+CVE-2021-41563 (Tad Book3 editing book function does not filter special
characters. Un ...)
+ TODO: check
CVE-2021-41562
RESERVED
CVE-2021-41561
@@ -2521,7 +2545,7 @@ CVE-2021-40980
RESERVED
CVE-2021-40979
RESERVED
-CVE-2021-40978 (The mkdocs 1.2.2 built-in dev-server allows directory
traversal using ...)
+CVE-2021-40978 (** DISPUTED ** The mkdocs 1.2.2 built-in dev-server allows
directory t ...)
TODO: check
CVE-2021-40977
RESERVED
@@ -2861,8 +2885,8 @@ CVE-2021-40834
RESERVED
CVE-2021-40833
RESERVED
-CVE-2021-40832
- RESERVED
+CVE-2021-40832 (A Denial-of-Service (DoS) vulnerability was discovered in
F-Secure Atl ...)
+ TODO: check
CVE-2021-40831
RESERVED
CVE-2021-40830
@@ -12483,8 +12507,8 @@ CVE-2021-3652 [CRYPT password hash with asterisk allows
any bind attempt to succ
NOTE: https://github.com/389ds/389-ds-base/issues/4817
NOTE:
https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7
(master)
NOTE:
https://github.com/389ds/389-ds-base/commit/c1926dfc6591b55c4d33f9944de4d7ebe077e964
(1.4.4.x)
-CVE-2021-36767
- RESERVED
+CVE-2021-36767 (In Digi RealPort through 4.8.488.0, authentication relies on a
challen ...)
+ TODO: check
CVE-2021-36766 (Concrete5 through 8.5.5 deserializes Untrusted Data. The
vulnerable co ...)
NOT-FOR-US: Concrete5
CVE-2021-36765 (In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP
requests ma ...)
@@ -14376,12 +14400,12 @@ CVE-2021-35981 (Acrobat Reader DC versions
2021.005.20054 (and earlier), 2020.00
NOT-FOR-US: Adobe
CVE-2021-35980
RESERVED
-CVE-2021-35979
- RESERVED
+CVE-2021-35979 (An issue was discovered in Digi RealPort through 4.8.488.0.
The 'encry ...)
+ TODO: check
CVE-2021-35978
RESERVED
-CVE-2021-35977
- RESERVED
+CVE-2021-35977 (An issue was discovered in Digi RealPort for Windows through
4.8.488.0 ...)
+ TODO: check
CVE-2021-35976 (The feature to preview a website in Plesk Obsidian 18.0.0
through 18.0 ...)
NOT-FOR-US: Plesk Obsidian
CVE-2021-35975
@@ -19817,8 +19841,8 @@ CVE-2021-33605 (Improper check in CheckboxGroup in
com.vaadin:vaadin-checkbox-fl
NOT-FOR-US: com.vaadin:vaadin-checkbox-flow
CVE-2021-33604 (URL encoding error in development mode handler in
com.vaadin:flow-serv ...)
NOT-FOR-US: com.vaadin:flow-server
-CVE-2021-33603
- RESERVED
+CVE-2021-33603 (A Denial-of-Service (DoS) vulnerability was discovered in
F-Secure Atl ...)
+ TODO: check
CVE-2021-33602 (A vulnerability affecting the F-Secure Antivirus engine was
discovered ...)
NOT-FOR-US: F-Secure
CVE-2021-33601 (A vulnerability was discovered in the web user interface of
F-Secure I ...)
@@ -23819,8 +23843,7 @@ CVE-2021-32055 (Mutt 1.11.0 through 2.0.x before 2.0.7
(and NeoMutt 2019-10-25 t
NOTE: imap_qresync not enabled by default and considered an
experimental feature
CVE-2021-32030 (The administrator application on ASUS GT-AC2900 devices before
3.0.0.4 ...)
NOT-FOR-US: ASUS
-CVE-2021-32029
- RESERVED
+CVE-2021-32029 (A flaw was found in postgresql. Using an UPDATE ... RETURNING
command ...)
{DSA-4915-1}
- postgresql-13 13.3-1
- postgresql-11 <removed>
@@ -29558,8 +29581,8 @@ CVE-2021-29908 (The IBM TS7700 Management Interface is
vulnerable to unauthentic
NOT-FOR-US: IBM
CVE-2021-29907 (IBM OpenPages with Watson 8.1 and 8.2 could allow an
authenticated use ...)
NOT-FOR-US: IBM
-CVE-2021-29906
- RESERVED
+CVE-2021-29906 (IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2,
1.3, 1.4 ...)
+ TODO: check
CVE-2021-29905 (IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli
Netcool/OMNIbu ...)
NOT-FOR-US: IBM
CVE-2021-29904 (IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli
Netcool/OMNIbu ...)
@@ -38439,8 +38462,8 @@ CVE-2021-3314 (** UNSUPPORTED WHEN ASSIGNED ** Oracle
GlassFish Server 3.1.2.18
NOT-FOR-US: Oracle
CVE-2021-3313 (Plone CMS until version 5.2.4 has a stored Cross-Site Scripting
(XSS) ...)
NOT-FOR-US: Plone
-CVE-2021-3312
- RESERVED
+CVE-2021-3312 (An XML external entity (XXE) vulnerability in Alkacon OpenCms
11.0, 11 ...)
+ TODO: check
CVE-2021-3311 (An issue was discovered in October through build 471. It
reactivates a ...)
NOT-FOR-US: October CMS
CVE-2021-3310 (Western Digital My Cloud OS 5 devices before 5.10.122 mishandle
Symbol ...)
@@ -53378,8 +53401,8 @@ CVE-2021-20602 (Improper Handling of Exceptional
Conditions vulnerability in GOT
NOT-FOR-US: Mitsubishi
CVE-2021-20601
RESERVED
-CVE-2021-20600
- RESERVED
+CVE-2021-20600 (Uncontrolled resource consumption in MELSEC iQ-R series C
Controller M ...)
+ TODO: check
CVE-2021-20599
RESERVED
CVE-2021-20598 (Overly Restrictive Account Lockout Mechanism vulnerability in
Mitsubis ...)
@@ -77971,8 +77994,8 @@ CVE-2020-22619
RESERVED
CVE-2020-22618
RESERVED
-CVE-2020-22617
- RESERVED
+CVE-2020-22617 (Ardour v5.12 contains a use-after-free vulnerability in the
component ...)
+ TODO: check
CVE-2020-22616
RESERVED
CVE-2020-22615
@@ -123582,8 +123605,8 @@ CVE-2020-4656
RESERVED
CVE-2020-4655 (IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through
6.0.3.2 a ...)
NOT-FOR-US: IBM
-CVE-2020-4654
- RESERVED
+CVE-2020-4654 (IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow
an authe ...)
+ TODO: check
CVE-2020-4653 (IBM Planning Analytics 2.0 could allow a remote attacker to
conduct ph ...)
NOT-FOR-US: IBM
CVE-2020-4652
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fb06411247aed89176d0dc3aa993b0f0007f9e5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fb06411247aed89176d0dc3aa993b0f0007f9e5
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
