Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e748e338 by Salvatore Bonaccorso at 2022-03-02T22:10:09+01:00
Process NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3531,7 +3531,7 @@ CVE-2022-25018 (Pluxml v5.8.7 was discovered to allow
attackers to execute arbit
CVE-2022-25017
RESERVED
CVE-2022-25016 (Home Owners Collection Management System v1.0 was discovered
to contai ...)
- TODO: check
+ NOT-FOR-US: Home Owners Collection Management System
CVE-2022-25015 (A stored cross-site scripting (XSS) vulnerability in Ice Hrm
30.0.0.OS ...)
NOT-FOR-US: Ice Hrm
CVE-2022-25014 (Ice Hrm 30.0.0.OS was discovered to contain a reflected
cross-site scr ...)
@@ -4967,7 +4967,7 @@ CVE-2022-24448 (An issue was discovered in fs/nfs/dir.c
in the Linux kernel befo
- linux 5.16.7-1
NOTE: Fixed by:
https://git.kernel.org/linus/ac795161c93699d600db16c1a8cc23a65a1eceaf (5.17-rc2)
CVE-2022-24447 (An issue was discovered in Zoho ManageEngine Key Manager Plus
before 6 ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-24446 (An issue was discovered in Zoho ManageEngine Key Manager Plus
6.1.6. A ...)
NOT-FOR-US: Zoho ManageEngine
CVE-2022-24445
@@ -5405,9 +5405,9 @@ CVE-2022-24308
CVE-2022-24307 (Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect
access cont ...)
NOT-FOR-US: Mastodon
CVE-2022-24306 (Zoho ManageEngine SharePoint Manager Plus before 4329 allows
account t ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-24305 (Zoho ManageEngine SharePoint Manager Plus before 4329 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-24304
RESERVED
CVE-2022-24303
@@ -5762,15 +5762,15 @@ CVE-2022-24257
CVE-2022-24256
RESERVED
CVE-2022-24255 (Extensis Portfolio v4.0 was discovered to contain hardcoded
credential ...)
- TODO: check
+ NOT-FOR-US: Extensis Portfolio
CVE-2022-24254 (An unrestricted file upload vulnerability in the
Backup/Restore Archiv ...)
- TODO: check
+ NOT-FOR-US: Extensis Portfolio
CVE-2022-24253 (Extensis Portfolio v4.0 was discovered to contain an
authenticated unr ...)
- TODO: check
+ NOT-FOR-US: Extensis Portfolio
CVE-2022-24252 (An unrestricted file upload vulnerability in the
FileTransferServlet c ...)
- TODO: check
+ NOT-FOR-US: Extensis Portfolio
CVE-2022-24251 (Extensis Portfolio v4.0 was discovered to contain an
authenticated unr ...)
- TODO: check
+ NOT-FOR-US: Extensis Portfolio
CVE-2022-24250
RESERVED
CVE-2022-24249 (A Null Pointer Dereference vulnerability exists in GPAC 1.1.0
via the ...)
@@ -6698,9 +6698,9 @@ CVE-2022-23990 (Expat (aka libexpat) before 2.4.4 has an
integer overflow in the
CVE-2022-23989
RESERVED
CVE-2022-23988 (The WS Form LITE and Pro WordPress plugins before 1.8.176 do
not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-23987 (The WS Form LITE and Pro WordPress plugins before 1.8.176 do
not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-23984 (Sensitive information disclosure discovered in wpDiscuz
WordPress plug ...)
NOT-FOR-US: WordPress plugin
CVE-2022-23983 (Cross-Site Request Forgery (CSRF) vulnerability leading to
plugin Sett ...)
@@ -6988,9 +6988,9 @@ CVE-2022-23909
CVE-2022-23908
RESERVED
CVE-2022-23907 (CMS Made Simple v2.2.15 was discovered to contain a reflected
cross-si ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2022-23906 (CMS Made Simple v2.2.15 was discovered to contain a Remote
Command Exe ...)
- TODO: check
+ NOT-FOR-US: CMS Made Simple
CVE-2022-23905
RESERVED
CVE-2022-23904
@@ -7046,7 +7046,7 @@ CVE-2022-23880
CVE-2022-23879
RESERVED
CVE-2022-23878 (seacms V11.5 is affected by an arbitrary code execution
vulnerability ...)
- TODO: check
+ NOT-FOR-US: seacms
CVE-2022-23877
RESERVED
CVE-2022-23876
@@ -7744,7 +7744,7 @@ CVE-2022-0316
CVE-2022-0315
RESERVED
CVE-2022-23779 (Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes
the insta ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-23778
RESERVED
CVE-2022-23777
@@ -8759,7 +8759,7 @@ CVE-2022-23389 (PublicCMS v4.0 was discovered to contain
a remote code execution
CVE-2022-23388
RESERVED
CVE-2022-23387 (An issue was discovered in taocms 3.0.2. This is a SQL blind
injection ...)
- TODO: check
+ NOT-FOR-US: taocms
CVE-2022-23386
RESERVED
CVE-2022-23385
@@ -8773,13 +8773,13 @@ CVE-2022-23382
CVE-2022-23381
RESERVED
CVE-2022-23380 (There is a SQL injection vulnerability in the background of
taocms 3.0 ...)
- TODO: check
+ NOT-FOR-US: taocms
CVE-2022-23379 (Emlog v6.0 was discovered to contain a SQL injection
vulnerability via ...)
NOT-FOR-US: Emlog
CVE-2022-23378 (A Cross-Site Scripting (XSS) vulnerability exists within the
3.2.2 ver ...)
NOT-FOR-US: TastyIgniter
CVE-2022-23377 (Archeevo below 5.0 is affected by local file inclusion through
file=~/ ...)
- TODO: check
+ NOT-FOR-US: Archeevo
CVE-2022-23376 (WikiDocs version 0.1.18 has multiple reflected XSS
vulnerabilities on ...)
NOT-FOR-US: WikiDocs
CVE-2022-23375 (WikiDocs version 0.1.18 has an authenticated remote code
execution vul ...)
@@ -8963,7 +8963,7 @@ CVE-2021-46389 (IIPImage High Resolution Streaming Image
Server prior to commit
CVE-2021-46388 (** DISPUTED ** WAGO 750-8212 PFC200 G2 2ETH RS Firmware
version 03.05. ...)
NOT-FOR-US: WAGO
CVE-2021-46387 (ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by
Cross S ...)
- TODO: check
+ NOT-FOR-US: ZyXEL
CVE-2021-46386 (https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected
by: File U ...)
NOT-FOR-US: MCMS
CVE-2021-46385 (https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected
by: SQL In ...)
@@ -12533,13 +12533,13 @@ CVE-2022-22305
CVE-2022-22304
RESERVED
CVE-2022-22303 (An exposure of sensitive system information to an unauthorized
control ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2022-22302
RESERVED
CVE-2022-22301 (An improper neutralization of special elements used in an OS
Command v ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2022-22300 (A improper handling of insufficient permissions or privileges
in Forti ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2022-22299
RESERVED
CVE-2022-22298
@@ -13283,7 +13283,7 @@ CVE-2021-4189 [ftplib should not use the host from the
PASV response]
NOTE:
https://github.com/python/cpython/commit/4134f154ae2f621f25c5d698cc0f1748035a1b88
(v3.6.14)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2036020
CVE-2022-22262 (ROG Live Service’s function for deleting temp files
created by i ...)
- TODO: check
+ NOT-FOR-US: ROG Live
CVE-2022-0077
RESERVED
CVE-2022-0076
@@ -13587,15 +13587,15 @@ CVE-2021-45866
CVE-2021-45865
RESERVED
CVE-2021-45864 (tsMuxer git-c6a0277 was discovered to contain a segmentation
fault via ...)
- TODO: check
+ NOT-FOR-US: tsMuxer
CVE-2021-45863 (tsMuxer git-2678966 was discovered to contain a heap-based
buffer over ...)
- TODO: check
+ NOT-FOR-US: tsMuxer
CVE-2021-45862
RESERVED
CVE-2021-45861 (There is an Assertion `num <= INT_BIT' failed at
BitStreamReader::s ...)
- TODO: check
+ NOT-FOR-US: tsMuxer
CVE-2021-45860 (An integer overflow in DTSStreamReader::findFrame() of tsMuxer
git-267 ...)
- TODO: check
+ NOT-FOR-US: tsMuxer
CVE-2021-45859
RESERVED
CVE-2021-45858
@@ -14600,7 +14600,7 @@ CVE-2021-4155
NOTE:
https://git.kernel.org/linus/983d8e60f50806f90534cc5373d0ce867e5aaf79 (5.16)
NOTE: https://www.openwall.com/lists/oss-security/2022/01/10/1
CVE-2020-36510 (The 15Zine WordPress theme before 3.3.0 does not sanitise and
escape t ...)
- TODO: check
+ NOT-FOR-US: WordPress theme
CVE-2022-22261
RESERVED
CVE-2022-22260
@@ -15170,7 +15170,7 @@ CVE-2021-45416 (Reflected Cross-site scripting (XSS)
vulnerability in RosarioSIS
CVE-2021-45415
RESERVED
CVE-2021-45414 (A Remote Code Execution (RCE) vulnerability exists in
DataRobot throug ...)
- TODO: check
+ NOT-FOR-US: DataRobot
CVE-2021-45413
RESERVED
CVE-2021-45412
@@ -17526,7 +17526,7 @@ CVE-2021-44749
CVE-2021-44748
RESERVED
CVE-2021-44747 (A Denial-of-Service (DoS) vulnerability was discovered in
F-Secure Lin ...)
- TODO: check
+ NOT-FOR-US: F-Secure
CVE-2021-44746 (UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0
and prior ...)
NOT-FOR-US: UNIVERGE
CVE-2021-44745
@@ -18307,7 +18307,7 @@ CVE-2021-4040
RESERVED
NOT-FOR-US: Red Hat AMQ Broker
CVE-2021-4039 (A command injection vulnerability in the web interface of the
Zyxel NW ...)
- TODO: check
+ NOT-FOR-US: Zyxel
CVE-2021-44520
RESERVED
CVE-2021-44519
@@ -18719,13 +18719,13 @@ CVE-2021-44344
CVE-2021-44343
RESERVED
CVE-2021-44342 (David Brackeen ok-file-formats 203defd is vulnerable to Buffer
Overflo ...)
- TODO: check
+ NOT-FOR-US: ok-file-formats
CVE-2021-44341
RESERVED
CVE-2021-44340 (David Brackeen ok-file-formats dev version is vulnerable to
Buffer Ove ...)
- TODO: check
+ NOT-FOR-US: ok-file-formats
CVE-2021-44339 (David Brackeen ok-file-formats 203defd is vulnerable to Buffer
Overflo ...)
- TODO: check
+ NOT-FOR-US: ok-file-formats
CVE-2021-44338
RESERVED
CVE-2021-44337
@@ -18735,13 +18735,13 @@ CVE-2021-44336
CVE-2021-44335
RESERVED
CVE-2021-44334 (David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer
Overflo ...)
- TODO: check
+ NOT-FOR-US: ok-file-formats
CVE-2021-44333
RESERVED
CVE-2021-44332
RESERVED
CVE-2021-44331 (ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function
encode_ ...)
- TODO: check
+ NOT-FOR-US: ARM astcenc
CVE-2021-44330
RESERVED
CVE-2021-44329
@@ -18933,7 +18933,7 @@ CVE-2021-44240
CVE-2021-44239
RESERVED
CVE-2021-44238 (AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via
/aya/mod ...)
- TODO: check
+ NOT-FOR-US: AyaCMS
CVE-2021-44237
RESERVED
CVE-2021-44236
@@ -19278,7 +19278,7 @@ CVE-2021-44168 (A download of code without integrity
check vulnerability in the
CVE-2021-44167
RESERVED
CVE-2021-44166 (An improper access control vulnerability [CWE-284 ] in
FortiToken Mobi ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2021-44165 (A vulnerability has been identified in POWER METER SICAM Q100
(All ver ...)
NOT-FOR-US: Siemens
CVE-2021-44164 (Chain Sea ai chatbot system’s file upload function has
insuffici ...)
@@ -20283,7 +20283,7 @@ CVE-2021-43947 (Affected versions of Atlassian Jira
Server and Data Center allow
CVE-2021-43946 (Affected versions of Atlassian Jira Server and Data Center
allow authe ...)
NOT-FOR-US: Atlassian
CVE-2021-43945 (Affected versions of Atlassian Jira Server and Data Center
allow remot ...)
- TODO: check
+ NOT-FOR-US: Atlassian
CVE-2021-43944
RESERVED
CVE-2021-43943 (Affected versions of Atlassian Jira Service Management Server
and Data ...)
@@ -24351,7 +24351,7 @@ CVE-2021-43088
CVE-2021-43087
RESERVED
CVE-2021-43086 (ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the
compressi ...)
- TODO: check
+ NOT-FOR-US: ARM astcenc
CVE-2021-43085
RESERVED
CVE-2021-43084
@@ -24386,11 +24386,11 @@ CVE-2021-43079
CVE-2021-43078
RESERVED
CVE-2021-43077 (A improper neutralization of special elements used in an sql
command ( ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2021-43076
RESERVED
CVE-2021-43075 (A improper neutralization of special elements used in an os
command (' ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2021-43074
RESERVED
CVE-2021-43073 (A improper neutralization of special elements used in an os
command (' ...)
@@ -24400,7 +24400,7 @@ CVE-2021-43072
CVE-2021-43071 (A heap-based buffer overflow in Fortinet FortiWeb version
6.4.1 and 6. ...)
NOT-FOR-US: FortiGuard
CVE-2021-43070 (Multiple relative path traversal vulnerabilities [CWE-23] in
FortiWLM ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2021-43069
RESERVED
CVE-2021-43068 (A improper authentication in Fortinet FortiAuthenticator
version 6.4.0 ...)
@@ -24730,7 +24730,7 @@ CVE-2021-42953
CVE-2021-42952 (Zepl Notebooks before 2021-10-25 are affected by a sandbox
escape vuln ...)
NOT-FOR-US: Zepl Notebooks
CVE-2021-42951 (A Remote Code Execution (RCE) vulnerability exists in
Algorithmia MSOL ...)
- TODO: check
+ NOT-FOR-US: Algorithmia MSOL
CVE-2021-42950
RESERVED
CVE-2021-42949
@@ -29083,7 +29083,7 @@ CVE-2021-41654
CVE-2021-41653 (The PING function on the TP-Link TL-WR840N EU v5 router with
firmware ...)
NOT-FOR-US: TP-Link
CVE-2021-41652 (Insecure permissions in the file database.sdb of BatFlat CMS
v1.3.6 al ...)
- TODO: check
+ NOT-FOR-US: BatFlat CMS
CVE-2021-41651 (A blind SQL injection vulnerability exists in the Raymart DG /
Ahmed H ...)
NOT-FOR-US: Raymart DG / Ahmed Helal Hotel-mgmt-system
CVE-2021-41650
@@ -29957,7 +29957,7 @@ CVE-2021-41284
CVE-2021-41283
RESERVED
CVE-2021-41282 (diag_routes.php in pfSense 2.5.2 allows sed data injection.
Authentica ...)
- TODO: check
+ NOT-FOR-US: pfSense
CVE-2021-41281 (Synapse is a package for Matrix homeservers written in Python
3/Twiste ...)
- matrix-synapse 1.47.1-1 (bug #1000451)
NOTE:
https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e748e3382915f3d12ea583e3e4707e659ea47195
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e748e3382915f3d12ea583e3e4707e659ea47195
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
