Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ad21bc85 by Salvatore Bonaccorso at 2022-01-20T22:37:12+01:00
Process NFUs
- - - - -
a6a192df by Salvatore Bonaccorso at 2022-01-20T22:37:57+01:00
Fix typo in NFU entry
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -855,23 +855,23 @@ CVE-2022-0287
CVE-2022-0286
RESERVED
CVE-2022-0285 (Cross-site Scripting (XSS) - Stored in Packagist
pimcore/pimcore prior ...)
- TODO: check
+ NOT-FOR-US: pimcore
CVE-2022-0284
RESERVED
CVE-2022-0283
RESERVED
CVE-2022-0282 (Code Injection in Packagist microweber/microweber prior to
1.2.11. ...)
- TODO: check
+ NOT-FOR-US: microweber
CVE-2022-0281 (Exposure of Sensitive Information to an Unauthorized Actor in
Packagis ...)
- TODO: check
+ NOT-FOR-US: microweber
CVE-2022-0280
RESERVED
CVE-2022-0279
RESERVED
CVE-2022-0278 (Cross-site Scripting (XSS) - Stored in Packagist
microweber/microweber ...)
- TODO: check
+ NOT-FOR-US: microweber
CVE-2022-0277 (Improper Access Control in Packagist microweber/microweber
prior to 1. ...)
- TODO: check
+ NOT-FOR-US: microweber
CVE-2021-46401
RESERVED
CVE-2021-46400
@@ -1738,7 +1738,7 @@ CVE-2021-45729
CVE-2021-44779
RESERVED
CVE-2021-44777 (Cross-Site Request Forgery (CSRF) vulnerabilities leading to
single or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2021-44760
RESERVED
CVE-2021-4207
@@ -4527,7 +4527,7 @@ CVE-2021-46106
CVE-2021-46105
RESERVED
CVE-2021-46104 (An issue was discovered in webp_server_go 0.4.0. There is a
directory ...)
- TODO: check
+ NOT-FOR-US: webp_server_go
CVE-2021-46103
RESERVED
CVE-2021-46102
@@ -4721,13 +4721,13 @@ CVE-2021-46030 (There is a Cross Site Scripting attack
(XSS) vulnerability in Ja
CVE-2021-46029
RESERVED
CVE-2021-46028 (In mblog <= 3.5.0 there is a CSRF vulnerability in the
background a ...)
- TODO: check
+ NOT-FOR-US: mblog
CVE-2021-46027 (mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the
backgro ...)
- TODO: check
+ NOT-FOR-US: mysiteforme
CVE-2021-46026 (mysiteforme, as of 19-12-2022, is vulnerable to Cross Site
Scripting ( ...)
- TODO: check
+ NOT-FOR-US: mysiteforme
CVE-2021-46025 (A Cross SIte Scripting (XSS) vulnerability exists in OneBlog
<= 2.2 ...)
- TODO: check
+ NOT-FOR-US: OneBlog
CVE-2021-46024
RESERVED
CVE-2021-46023
@@ -8983,7 +8983,7 @@ CVE-2021-44831
CVE-2021-44830
RESERVED
CVE-2021-44829 (Cross Site Scripting (XSS) vulnerability exists in index.html
in AFI W ...)
- TODO: check
+ NOT-FOR-US: AFI WebACMS
CVE-2021-44828 (Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0,
Bifrost r0p0 ...)
NOT-FOR-US: ARM
CVE-2021-44827
@@ -9316,15 +9316,15 @@ CVE-2021-XXXX [Rainloop stores passwords in cleartext
in logfile]
[buster] - rainloop <no-dsa> (Minor issue)
NOTE: https://github.com/RainLoop/rainloop-webmail/issues/1872
CVE-2021-44738 (Buffer overflow vulnerability has been identified in Lexmark
devices t ...)
- TODO: check
+ NOT-FOR-US: Lexmark
CVE-2021-44737 (PJL directory traversal vulnerability in Lexmark devices
through 2021- ...)
- TODO: check
+ NOT-FOR-US: Lexmark
CVE-2021-44736 (The initial admin account setup wizard on Lexmark devices
allow unauth ...)
- TODO: check
+ NOT-FOR-US: Lexmark
CVE-2021-44735 (Embedded web server command injection vulnerability in Lexmark
devices ...)
- TODO: check
+ NOT-FOR-US: Lexmark
CVE-2021-44734 (Embedded web server input sanitization vulnerability in
Lexmark device ...)
- TODO: check
+ NOT-FOR-US: Lexmark
CVE-2021-44733 (A use-after-free exists in drivers/tee/tee_shm.c in the TEE
subsystem ...)
- linux <unfixed>
[stretch] - linux <not-affected> (Vulnerable code not present)
@@ -10619,9 +10619,9 @@ CVE-2021-44247
CVE-2021-44246
RESERVED
CVE-2021-44245 (An SQL Injection vulnerability exists in Courcecodester COVID
19 Testi ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester COVID 19 Testing Management System (CTMS)
CVE-2021-44244 (An SQL Injection vulnerabiity exists in Sourcecodester
Logistic Hub Pa ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester Logistic Hub Parcel's Management System
CVE-2021-44243
RESERVED
CVE-2021-44242
@@ -11175,11 +11175,11 @@ CVE-2021-44094 (ZrLog 2.2.2 has a remote command
execution vulnerability at plug
CVE-2021-44093 (A Remote Command Execution vulnerability on the background in
zrlog 2. ...)
NOT-FOR-US: zrlog
CVE-2021-44092 (An SQL Injection vulnerability exists in code-projects
Pharmacy Manage ...)
- TODO: check
+ NOT-FOR-US: code-projects Pharmacy Management
CVE-2021-44091 (A Cross-Site Scripting (XSS) vulnerability exists in
Courcecodester Mu ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester Multi Restaurant Table Reservation System
CVE-2021-44090 (An SQL Injection vulnerability exists in Sourcecodester Online
Reviewe ...)
- TODO: check
+ NOT-FOR-US: Sourcecodester Online Reviewer System
CVE-2021-44089
RESERVED
CVE-2021-44088
@@ -11673,7 +11673,7 @@ CVE-2022-21703
CVE-2022-21702
RESERVED
CVE-2022-21701 (Istio is an open platform to connect, manage, and secure
microservices ...)
- TODO: check
+ NOT-FOR-US: Istio
CVE-2022-21700 (Micronaut is a JVM-based, full stack Java framework designed
for build ...)
TODO: check
CVE-2022-21699 (IPython (Interactive Python) is a command shell for
interactive comput ...)
@@ -11732,7 +11732,7 @@ CVE-2022-21681 (Marked is a markdown parser and
compiler. Prior to version 4.0.1
CVE-2022-21680 (Marked is a markdown parser and compiler. Prior to version
4.0.10, the ...)
TODO: check
CVE-2022-21679 (Istio is an open platform to connect, manage, and secure
microservices ...)
- TODO: check
+ NOT-FOR-US: Istio
CVE-2022-21678 (Discourse is an open source discussion platform. Prior to
version 2.8. ...)
NOT-FOR-US: Discourse
CVE-2022-21677 (Discourse is an open source discussion platform. Discourse
groups can ...)
@@ -14463,7 +14463,7 @@ CVE-2021-43271
CVE-2021-43270 (Datalust Seq.App.EmailPlus (aka seq-app-htmlemail)
3.1.0-dev-00148, 3. ...)
NOT-FOR-US: Datalust Seq.App.HtmlEmail (aka Seq.App.EmailPlus)
CVE-2021-43269 (In Code42 app before 8.8.0, eval injection allows an attacker
to chang ...)
- TODO: check
+ NOT-FOR-US: Code42 app
CVE-2021-43268 (An issue was discovered in VxWorks 6.9 through 7. In the IKE
component ...)
NOT-FOR-US: Wind River VxWorks
CVE-2021-43266 (In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0,
exporting col ...)
@@ -19702,7 +19702,7 @@ CVE-2021-42010
CVE-2021-42009 (An authenticated Apache Traffic Control Traffic Ops user with
Portal-l ...)
NOT-FOR-US: Apache Traffic Control
CVE-2021-3862 (icecoder is vulnerable to Improper Neutralization of Input
During Web ...)
- TODO: check
+ NOT-FOR-US: icecoder
CVE-2021-3861
RESERVED
CVE-2021-3860 (JFrog Artifactory before 7.25.4 (Enterprise+ deployments only),
is vul ...)
@@ -19793,7 +19793,7 @@ CVE-2021-41974 (Tad Book3 editing book page does not
perform identity verificati
CVE-2021-3858 (snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) ...)
NOT-FOR-US: snipe-it
CVE-2021-3857 (chaskiq is vulnerable to Improper Neutralization of Input
During Web P ...)
- TODO: check
+ NOT-FOR-US: chaskiq
CVE-2021-41973 (In Apache MINA, a specifically crafted, malformed HTTP request
may cau ...)
NOT-FOR-US: Apache MINA
CVE-2021-41972 (Apache Superset up to and including 1.3.1 allowed for database
connect ...)
@@ -20026,7 +20026,7 @@ CVE-2021-41867 (An information disclosure vulnerability
in OnionShare 2.3 before
CVE-2021-41866 (MyBB before 1.8.28 allows stored XSS because the displayed
Template Na ...)
NOT-FOR-US: MyBB
CVE-2021-3853 (chaskiq is vulnerable to Improper Neutralization of Input
During Web P ...)
- TODO: check
+ NOT-FOR-US: chaskiq
CVE-2021-3852 (growi is vulnerable to Authorization Bypass Through
User-Controlled Ke ...)
TODO: check
CVE-2021-41865 (HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5
allowed authe ...)
@@ -35236,15 +35236,15 @@ CVE-2021-35689
CVE-2021-35688
RESERVED
CVE-2021-35687 (Vulnerability in the Oracle Financial Services Analytical
Applications ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2021-35686 (Vulnerability in the Oracle Financial Services Analytical
Applications ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2021-35685
RESERVED
CVE-2021-35684
RESERVED
CVE-2021-35683 (Vulnerability in the Oracle Essbase Administration Services
product of ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2021-35682
RESERVED
CVE-2021-35681
@@ -35447,7 +35447,7 @@ CVE-2021-35588 (Vulnerability in the Java SE, Oracle
GraalVM Enterprise Edition
{DLA-2814-1}
- openjdk-8 8u312-b07-1
CVE-2021-35587 (Vulnerability in the Oracle Access Manager product of Oracle
Fusion Mi ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2021-35586 (Vulnerability in the Java SE, Oracle GraalVM Enterprise
Edition produc ...)
{DSA-5000-2 DSA-5012-1 DSA-5000-1 DLA-2814-1}
- openjdk-17 17.0.1+12-1
@@ -37143,7 +37143,7 @@ CVE-2021-34860 (This vulnerability allows
network-adjacent attackers to disclose
CVE-2021-34859 (This vulnerability allows remote attackers to execute
arbitrary code o ...)
NOT-FOR-US: TeamViewer
CVE-2021-34858 (This vulnerability allows remote attackers to execute
arbitrary code o ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2021-34857 (This vulnerability allows local attackers to escalate
privileges on af ...)
NOT-FOR-US: Parallels Desktop
CVE-2021-34856 (This vulnerability allows local attackers to escalate
privileges on af ...)
@@ -37755,7 +37755,7 @@ CVE-2021-34602
CVE-2021-34601
RESERVED
CVE-2021-34600 (Telenot CompasX versions prior to 32.0 use a weak seed for
random numb ...)
- TODO: check
+ NOT-FOR-US: Telenot CompasX
CVE-2021-34599 (Affected versions of CODESYS Git in Versions prior to V1.1.0.0
lack ce ...)
NOT-FOR-US: CODESYS
CVE-2021-34598 (In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0,
1.4.1 an ...)
@@ -41530,7 +41530,7 @@ CVE-2021-33042
CVE-2021-33041 (vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as
demonstr ...)
NOT-FOR-US: vmd
CVE-2021-33040 (managers/views/iframe.js in FuturePress EPub.js before 0.3.89
allows X ...)
- TODO: check
+ NOT-FOR-US: FuturePress EPub.js
CVE-2021-33039
RESERVED
CVE-2021-33038 (An issue was discovered in
management/commands/hyperkitty_import.py in ...)
@@ -44684,7 +44684,7 @@ CVE-2021-31855 (KDE Messagelib through 5.17.0 reveals
cleartext of encrypted mes
NOTE: https://kde.org/info/security/advisory-20210429-1.txt
NOTE:
https://commits.kde.org/messagelib/3b5b171e91ce78b966c98b1292a1bcbc8d984799
CVE-2021-31854 (A command Injection Vulnerability in McAfee Agent (MA) for
Windows pri ...)
- TODO: check
+ NOT-FOR-US: McAfee
CVE-2021-31853 (DLL Search Order Hijacking Vulnerability in McAfee Drive
Encryption (M ...)
NOT-FOR-US: McAfee
CVE-2021-31852 (A Reflected Cross-Site Scripting vulnerability in McAfee
Policy Audito ...)
@@ -51759,7 +51759,7 @@ CVE-2021-29217
CVE-2021-29216
RESERVED
CVE-2021-29215 (A potential security vulnerability in HPE Ezmeral Data Fabric
that may ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2021-29214 (A security vulnerability has been identified in HPE StoreServ
Manageme ...)
NOT-FOR-US: HPE
CVE-2021-29213 (A potential local bypass of security restrictions
vulnerability has be ...)
@@ -64895,7 +64895,7 @@ CVE-2021-23845 (This vulnerability could allow an
attacker to hijack a session w
CVE-2021-23844
RESERVED
CVE-2021-23843 (The Bosch software tools AccessIPConfig.exe and
AmcIpConfig.exe are us ...)
- TODO: check
+ NOT-FOR-US: Bosch
CVE-2021-23842 (Communication to the AMC2 uses a state-of-the-art
cryptographic algori ...)
TODO: check
CVE-2021-23841 (The OpenSSL public API function X509_issuer_and_serial_hash()
attempts ...)
@@ -87696,7 +87696,7 @@ CVE-2020-27430
CVE-2020-27429
RESERVED
CVE-2020-27428 (A DOM-based cross-site scripting (XSS) vulnerability in
Scratch-Svg-Re ...)
- TODO: check
+ NOT-FOR-US: Scratch-Svg-Renderer
CVE-2020-27427
RESERVED
CVE-2020-27426
@@ -108498,7 +108498,7 @@ CVE-2020-18079
CVE-2020-18078 (A vulnerability in /include/web_check.php of SEMCMS v3.8
allows attack ...)
NOT-FOR-US: SEMCMS
CVE-2020-18077 (A buffer overflow vulnerability in the Virtual Path Mapping
component ...)
- TODO: check
+ NOT-FOR-US: FTPShell Server
CVE-2020-18076
RESERVED
CVE-2020-18075
@@ -118393,7 +118393,7 @@ CVE-2020-14112
CVE-2020-14111
RESERVED
CVE-2020-14110 (AX3600 router sensitive information leaked.There is an
unauthorized in ...)
- TODO: check
+ NOT-FOR-US: AX3600 router
CVE-2020-14109 (There is command injection in the meshd program in the routing
system, ...)
NOT-FOR-US: Xiaomi
CVE-2020-14108
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/df873965d9a7fc874cbd9029f79af5fb1121227f...a6a192dfc7137cb149c0d9c1a030146d8daf7221
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/df873965d9a7fc874cbd9029f79af5fb1121227f...a6a192dfc7137cb149c0d9c1a030146d8daf7221
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
