Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2e993028 by security tracker role at 2022-03-18T08:10:13+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,29 @@
+CVE-2022-27240 (scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has
a buffer ...)
+ TODO: check
+CVE-2022-27239
+ RESERVED
+CVE-2022-27238
+ RESERVED
+CVE-2022-27237
+ RESERVED
+CVE-2022-27236
+ RESERVED
+CVE-2022-26887
+ RESERVED
+CVE-2022-26667
+ RESERVED
+CVE-2022-26666
+ RESERVED
+CVE-2022-26514
+ RESERVED
+CVE-2022-26349
+ RESERVED
+CVE-2022-25880
+ RESERVED
+CVE-2022-1019
+ RESERVED
+CVE-2022-1018
+ RESERVED
CVE-2022-27172
RESERVED
CVE-2022-1017
@@ -165,8 +191,7 @@ CVE-2022-27193 (CVRF-CSAF-Converter before 1.0.0-rc2
resolves XML External Entit
TODO: check
CVE-2022-27192
RESERVED
-CVE-2022-27191
- RESERVED
+CVE-2022-27191 (golang.org/x/crypto/ssh before
0.0.0-20220314234659-1baeb1ce4c0b in Go ...)
- golang-go.crypto 1:0.0~git20220315.3147a52-1
NOTE:
https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ
NOTE:
https://github.com/golang/crypto/commit/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d
@@ -816,8 +841,8 @@ CVE-2022-26966 (An issue was discovered in the Linux kernel
before 5.16.12. driv
[bullseye] - linux 5.10.103-1
[buster] - linux 4.19.232-1
NOTE:
https://git.kernel.org/linus/e9da0b56fe27206b49f39805f7dcda8a89379062 (5.17-rc6)
-CVE-2022-26965
- RESERVED
+CVE-2022-26965 (In Pluck 4.7.16, an admin user can use the theme upload
functionality ...)
+ TODO: check
CVE-2022-26964
RESERVED
CVE-2022-26963
@@ -1909,16 +1934,16 @@ CVE-2022-26505 (A DNS rebinding issue in ReadyMedia
(formerly MiniDLNA) before 1
[buster] - minidlna <no-dsa> (Minor issue)
NOTE:
https://sourceforge.net/p/minidlna/git/ci/c21208508dbc131712281ec5340687e5ae89e940/
NOTE: https://www.openwall.com/lists/oss-security/2022/03/03/1
-CVE-2022-26504
- RESERVED
+CVE-2022-26504 (Improper authentication in Veeam Backup & Replication
9.5U3, 9.5U4 ...)
+ TODO: check
CVE-2022-26503 (Deserialization of untrusted data in Veeam Agent for Windows
2.0, 2.1, ...)
NOT-FOR-US: Veeam
CVE-2022-26502
RESERVED
-CVE-2022-26501
- RESERVED
-CVE-2022-26500
- RESERVED
+CVE-2022-26501 (Improper authentication in Veeam Backup & Replication
9.5U3, 9.5U4 ...)
+ TODO: check
+CVE-2022-26500 (Improper limitation of path names in Veeam Backup &
Replication 9. ...)
+ TODO: check
CVE-2022-26499
RESERVED
CVE-2022-26498
@@ -3703,10 +3728,10 @@ CVE-2022-21126
RESERVED
CVE-2022-21122
RESERVED
-CVE-2022-0758
- RESERVED
-CVE-2022-0757
- RESERVED
+CVE-2022-0758 (Rapid7 Nexpose versions 6.6.129 and earlier suffer from a
reflected cr ...)
+ TODO: check
+CVE-2022-0757 (Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to
an SQL I ...)
+ TODO: check
CVE-2022-0756 (Improper Authorization in GitHub repository
salesagility/suitecrm prio ...)
NOT-FOR-US: SuiteCRM
CVE-2022-0755 (Improper Access Control in GitHub repository
salesagility/suitecrm pri ...)
@@ -6614,8 +6639,8 @@ CVE-2022-24772
RESERVED
CVE-2022-24771
RESERVED
-CVE-2022-24770
- RESERVED
+CVE-2022-24770 (`gradio` is an open source framework for building interactive
machine ...)
+ TODO: check
CVE-2022-24769
RESERVED
CVE-2022-24768
@@ -7989,8 +8014,8 @@ CVE-2022-24303
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2052682
NOTE:
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
NOTE:
https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
(9.0.1)
-CVE-2022-24302
- RESERVED
+CVE-2022-24302 (In Paramiko before 2.10.1, a race condition (between creation
and chmo ...)
+ TODO: check
CVE-2022-24296
RESERVED
CVE-2022-24295 (Okta Advanced Server Access Client for Windows prior to
version 1.57.0 ...)
@@ -12105,8 +12130,8 @@ CVE-2022-23220 (USBView 2.1 before 2.2 allows some
local users (e.g., ones logge
NOTE: Introduced by:
https://github.com/gregkh/usbview/commit/ddefeba3f67d6a6f394eb57352254c1c8a312671
(v2.1)
NOTE: Fixed by:
https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b
(v2.2)
NOTE: Hardening:
https://github.com/gregkh/usbview/commit/1282782301570b3ee27f82f4f34c2c1a82bfd91a
(v2.2)
-CVE-2022-0237
- RESERVED
+CVE-2022-0237 (Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from
a privi ...)
+ TODO: check
CVE-2022-0236 (The WP Import Export WordPress plugin (both free and premium
versions) ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0235 (node-fetch is vulnerable to Exposure of Sensitive Information
to an Un ...)
@@ -15259,8 +15284,8 @@ CVE-2021-46109 (Invalid input sanitizing leads to
reflected Cross Site Scripting
NOT-FOR-US: ASUS
CVE-2021-46108 (D-Link DSL-2730E CT-20131125 devices allow XSS via the
username parame ...)
NOT-FOR-US: D-Link
-CVE-2021-46107
- RESERVED
+CVE-2021-46107 (Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to
Server S ...)
+ TODO: check
CVE-2021-46106
RESERVED
CVE-2021-46105
@@ -15633,12 +15658,12 @@ CVE-2021-45970 (An issue was discovered in IdeBusDxe
in Insyde InsydeH2O with ke
NOT-FOR-US: Insyde
CVE-2021-45969 (An issue was discovered in AhciBusDxe in Insyde InsydeH2O with
kernel ...)
NOT-FOR-US: Insyde
-CVE-2021-45968
- RESERVED
-CVE-2021-45967
- RESERVED
-CVE-2021-45966
- RESERVED
+CVE-2021-45968 (An issue was discovered in xmppserver jar in the XMPP Server
component ...)
+ TODO: check
+CVE-2021-45967 (An issue was discovered in Pascom Cloud Phone System before
7.20.x. A ...)
+ TODO: check
+CVE-2021-45966 (An issue was discovered in Pascom Cloud Phone System before
7.20.x. In ...)
+ TODO: check
CVE-2021-45965
RESERVED
CVE-2021-45964
@@ -16241,8 +16266,8 @@ CVE-2021-45870
RESERVED
CVE-2021-45869
RESERVED
-CVE-2021-45868
- RESERVED
+CVE-2021-45868 (In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does
not vali ...)
+ TODO: check
CVE-2021-45867
RESERVED
CVE-2021-45866
@@ -19322,8 +19347,8 @@ CVE-2021-4108 (snipe-it is vulnerable to Improper
Neutralization of Input During
NOT-FOR-US: snipe-it
CVE-2022-0010
RESERVED
-CVE-2021-45040
- RESERVED
+CVE-2021-45040 (The Spatie media-library-pro library through 1.17.10 and 2.x
through 2 ...)
+ TODO: check
CVE-2021-45039
RESERVED
CVE-2021-45038 (An issue was discovered in MediaWiki before 1.35.5, 1.36.x
before 1.36 ...)
@@ -19648,8 +19673,8 @@ CVE-2021-44909
RESERVED
CVE-2021-44908 (SailsJS Sails.js <=1.4.0 is vulnerable to Prototype
Pollution via c ...)
TODO: check
-CVE-2021-44907
- RESERVED
+CVE-2021-44907 (A Denial of Service vulnerability exists in qs up to 6.8.0 due
to insu ...)
+ TODO: check
CVE-2021-44906 (Minimist <=1.2.5 is vulnerable to Prototype Pollution via
file inde ...)
TODO: check
CVE-2021-44905
@@ -19990,8 +20015,8 @@ CVE-2021-4097 (phpservermon is vulnerable to Improper
Neutralization of CRLF Seq
NOT-FOR-US: phpservermon
CVE-2021-4096
RESERVED
-CVE-2022-21822
- RESERVED
+CVE-2022-21822 (NVIDIA FLARE contains a vulnerability in the admin interface,
where an ...)
+ TODO: check
CVE-2022-21821
RESERVED
CVE-2022-21820
@@ -22211,10 +22236,10 @@ CVE-2021-44090 (An SQL Injection vulnerability exists
in Sourcecodester Online R
NOT-FOR-US: Sourcecodester Online Reviewer System
CVE-2021-44089
RESERVED
-CVE-2021-44088
- RESERVED
-CVE-2021-44087
- RESERVED
+CVE-2021-44088 (An SQL Injection vulnerability exists in Sourcecodester
Attendance and ...)
+ TODO: check
+CVE-2021-44087 (A Remote Code Execution (RCE) vulnerability exists in
Sourcecodester A ...)
+ TODO: check
CVE-2021-44086
RESERVED
CVE-2021-44085
@@ -22615,8 +22640,8 @@ CVE-2021-43963 (An issue was discovered in Couchbase
Sync Gateway 2.7.0 through
NOT-FOR-US: Couchbase Sync Gateway
CVE-2021-43962
RESERVED
-CVE-2021-43961
- RESERVED
+CVE-2021-43961 (Sonatype Nexus Repository Manager 3.36.0 allows HTML
Injection. ...)
+ TODO: check
CVE-2021-43960 (** DISPUTED ** Lorensbergs Connect2 3.13.7647.20190 is
affected by an ...)
NOT-FOR-US: Lorensbergs Connect2
CVE-2021-3974 (vim is vulnerable to Use After Free ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e9930288d4e504c9e6c8004f14b348137cc9cf7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e9930288d4e504c9e6c8004f14b348137cc9cf7
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
