Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e52030bb by security tracker role at 2022-04-02T08:10:15+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,29 @@
+CVE-2022-28351
+ RESERVED
+CVE-2022-28350
+ RESERVED
+CVE-2022-28349
+ RESERVED
+CVE-2022-28348
+ RESERVED
+CVE-2022-28347
+ RESERVED
+CVE-2022-28346
+ RESERVED
+CVE-2022-28345
+ RESERVED
+CVE-2022-28344
+ RESERVED
+CVE-2022-28343
+ RESERVED
+CVE-2022-28342
+ RESERVED
+CVE-2022-1209
+ RESERVED
+CVE-2022-1208
+ RESERVED
+CVE-2022-1207 (Out-of-bounds read in GitHub repository radareorg/radare2 prior
to 5.6 ...)
+ TODO: check
CVE-2022-28341
RESERVED
CVE-2022-28340
@@ -558,8 +584,8 @@ CVE-2022-28162
RESERVED
CVE-2022-28161
RESERVED
-CVE-2022-1159
- RESERVED
+CVE-2022-1159 (Rockwell Automation Studio 5000 Logix Designer (all versions)
are vuln ...)
+ TODO: check
CVE-2022-1158
RESERVED
CVE-2022-1157
@@ -1322,8 +1348,8 @@ CVE-2022-1100
RESERVED
CVE-2022-1099
RESERVED
-CVE-2022-1098
- RESERVED
+CVE-2022-1098 (Delta Electronics DIAEnergie (all versions prior to 1.8.02.004)
are vu ...)
+ TODO: check
CVE-2021-46742
RESERVED
CVE-2021-46741
@@ -1366,8 +1392,8 @@ CVE-2022-27864
RESERVED
CVE-2022-27186
RESERVED
-CVE-2022-27177
- RESERVED
+CVE-2022-27177 (A Python format string issue leading to information disclosure
and pot ...)
+ TODO: check
CVE-2022-27171
RESERVED
CVE-2022-26371
@@ -1443,8 +1469,8 @@ CVE-2022-1070
RESERVED
CVE-2022-1069
RESERVED
-CVE-2022-1068
- RESERVED
+CVE-2022-1068 (Modbus Tools Modbus Slave (versions 7.4.2 and prior) is
vulnerable to ...)
+ TODO: check
CVE-2022-1067
RESERVED
CVE-2022-27863
@@ -2197,8 +2223,8 @@ CVE-2022-27536
RESERVED
CVE-2022-27535
RESERVED
-CVE-2022-27534
- RESERVED
+CVE-2022-27534 (Kaspersky Anti-Virus products for home and Kaspersky Endpoint
Security ...)
+ TODO: check
CVE-2022-27533
RESERVED
CVE-2022-27532
@@ -2667,8 +2693,8 @@ CVE-2022-27308
RESERVED
CVE-2022-27307
RESERVED
-CVE-2022-27306
- RESERVED
+CVE-2022-27306 (The function url.parse() in Node.js v17.7.0 allows attackers
to spoof ...)
+ TODO: check
CVE-2022-27305
RESERVED
CVE-2022-27304
@@ -2771,14 +2797,14 @@ CVE-2022-26519
RESERVED
CVE-2022-26516
RESERVED
-CVE-2022-26419
- RESERVED
-CVE-2022-26417
- RESERVED
-CVE-2022-26022
- RESERVED
-CVE-2022-25959
- RESERVED
+CVE-2022-26419 (Omron CX-Position (versions 2.5.3 and prior) is vulnerable to
multiple ...)
+ TODO: check
+CVE-2022-26417 (Omron CX-Position (versions 2.5.3 and prior) is vulnerable to
a use af ...)
+ TODO: check
+CVE-2022-26022 (Omron CX-Position (versions 2.5.3 and prior) is vulnerable to
an out-o ...)
+ TODO: check
+CVE-2022-25959 (Omron CX-Position (versions 2.5.3 and prior) is vulnerable to
memory c ...)
+ TODO: check
CVE-2022-1037
RESERVED
CVE-2022-1036 (Able to create an account with long password leads to memory
corruptio ...)
@@ -2883,8 +2909,8 @@ CVE-2022-25880 (Delta Electronics DIAEnergie (All
versions prior to 1.8.02.004)
NOT-FOR-US: Delta Electronics
CVE-2022-1019
RESERVED
-CVE-2022-1018
- RESERVED
+CVE-2022-1018 (When opening a malicious solution file provided by an attacker,
the ap ...)
+ TODO: check
CVE-2022-27172
RESERVED
CVE-2022-1017
@@ -4008,8 +4034,8 @@ CVE-2022-26850
RESERVED
CVE-2022-0923 (Delta Electronics DIAEnergie (All versions prior to 1.8.02.004)
has a ...)
NOT-FOR-US: Delta Electronics
-CVE-2022-0922
- RESERVED
+CVE-2022-0922 (The software does not perform any authentication for critical
system f ...)
+ TODO: check
CVE-2022-0921 (Abusing Backup/Restore feature to achieve Remote Code Execution
in Git ...)
NOT-FOR-US: microweber
CVE-2022-0920
@@ -4713,8 +4739,8 @@ CVE-2022-26567
RESERVED
CVE-2022-26566
RESERVED
-CVE-2022-26565
- RESERVED
+CVE-2022-26565 (A cross-site scripting (XSS) vulnerability in Totaljs commit
95f54a5 a ...)
+ TODO: check
CVE-2022-26564
RESERVED
CVE-2022-26563
@@ -6588,8 +6614,8 @@ CVE-2022-24278
RESERVED
CVE-2022-24068
RESERVED
-CVE-2022-24066
- RESERVED
+CVE-2022-24066 (The package simple-git before 3.5.0 are vulnerable to Command
Injectio ...)
+ TODO: check
CVE-2022-24065
RESERVED
CVE-2022-23923
@@ -6777,8 +6803,7 @@ CVE-2022-0742 (Memory leak in icmp6 implementation in
Linux Kernel 5.13+ allows
[stretch] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/2d3916f3189172d5c69d33065c3c21119fe539fc (5.17-rc7)
NOTE: https://www.openwall.com/lists/oss-security/2022/03/15/3
-CVE-2022-0741
- RESERVED
+CVE-2022-0741 (Improper input validation in all versions of GitLab CE/EE using
sendma ...)
[experimental] - gitlab 14.6.5+ds1-1
- gitlab <unfixed>
NOTE:
https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/
@@ -8589,18 +8614,18 @@ CVE-2022-25162
RESERVED
CVE-2022-25161
RESERVED
-CVE-2022-25160
- RESERVED
-CVE-2022-25159
- RESERVED
-CVE-2022-25158
- RESERVED
-CVE-2022-25157
- RESERVED
-CVE-2022-25156
- RESERVED
-CVE-2022-25155
- RESERVED
+CVE-2022-25160 (Cleartext Storage of Sensitive Information vulnerability in
Mitsubishi ...)
+ TODO: check
+CVE-2022-25159 (Authentication Bypass by Capture-replay vulnerability in
Mitsubishi El ...)
+ TODO: check
+CVE-2022-25158 (Cleartext Storage of Sensitive Information vulnerability in
Mitsubishi ...)
+ TODO: check
+CVE-2022-25157 (Use of Password Hash Instead of Password for Authentication
vulnerabil ...)
+ TODO: check
+CVE-2022-25156 (Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC
iQ-F seri ...)
+ TODO: check
+CVE-2022-25155 (Use of Password Hash Instead of Password for Authentication
vulnerabil ...)
+ TODO: check
CVE-2022-25154
RESERVED
CVE-2022-25153
@@ -10588,8 +10613,8 @@ CVE-2022-24428
RESERVED
CVE-2022-24427
RESERVED
-CVE-2022-24426
- RESERVED
+CVE-2022-24426 (Dell Command | Update, Dell Update, and Alienware Update
versions prio ...)
+ TODO: check
CVE-2022-24425
RESERVED
CVE-2022-24424
@@ -10761,8 +10786,7 @@ CVE-2022-0491
RESERVED
CVE-2022-0490
RESERVED
-CVE-2022-0489
- RESERVED
+CVE-2022-0489 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
[experimental] - gitlab 14.6.5+ds1-1
- gitlab <unfixed>
NOTE:
https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/
@@ -11354,8 +11378,8 @@ CVE-2022-0427 (Missing sanitization of HTML attributes
in Jupyter notebooks in a
TODO: check
CVE-2022-0426 (The Product Feed PRO for WooCommerce WordPress plugin before
11.2.3 do ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-0425
- RESERVED
+CVE-2022-0425 (A DNS rebinding vulnerability in the Irker IRC Gateway
integration in ...)
+ TODO: check
CVE-2022-0424
RESERVED
CVE-2022-0423 (The 3D FlipBook WordPress plugin before 1.12.1 does not have
authorisa ...)
@@ -12047,8 +12071,8 @@ CVE-2022-0391 (A flaw was found in Python, specifically
within the urllib.parse
NOTE: Fixed by:
https://github.com/python/cpython/commit/515a7bc4e13645d0945b46a8e1d9102b918cd407
(v3.8.11)
NOTE: Fixed by:
https://github.com/python/cpython/commit/f4dac7ec55477a6c5d965e594e74bd6bda786903
(v3.7.11)
NOTE: Fixed by:
https://github.com/python/cpython/commit/6c472d3a1d334d4eeb4a25eba7bf3b01611bf667
(v3.6.14)
-CVE-2022-0390
- RESERVED
+CVE-2022-0390 (Improper access control in Gitlab CE/EE versions 12.7 to
14.5.4, 14.6 ...)
+ TODO: check
CVE-2022-0389 (The WP Time Slots Booking Form WordPress plugin before 1.1.63
does not ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0388 (The Interactive Medical Drawing of Human Body WordPress plugin
through ...)
@@ -12409,8 +12433,8 @@ CVE-2022-0375 (Cross-site Scripting (XSS) - Stored in
Packagist remdex/livehelpe
NOT-FOR-US: livehelperchat
CVE-2022-0374 (Cross-site Scripting (XSS) - Stored in Packagist
remdex/livehelperchat ...)
NOT-FOR-US: livehelperchat
-CVE-2022-0373
- RESERVED
+CVE-2022-0373 (Improper access control in GitLab CE/EE versions 12.4 to
14.5.4, 14.5 ...)
+ TODO: check
CVE-2022-0372 (Cross-site Scripting (XSS) - Stored in Packagist
bytefury/crater prior ...)
NOT-FOR-US: Crater
CVE-2021-46561 (controller/org.controller/org.controller.js in the CVE
Services API 1. ...)
@@ -15495,14 +15519,14 @@ CVE-2022-23160
RESERVED
CVE-2022-23159
RESERVED
-CVE-2022-23158
- RESERVED
-CVE-2022-23157
- RESERVED
-CVE-2022-23156
- RESERVED
-CVE-2022-23155
- RESERVED
+CVE-2022-23158 (Wyse Device Agent version 14.6.1.4 and below contain a
sensitive data ...)
+ TODO: check
+CVE-2022-23157 (Wyse Device Agent version 14.6.1.4 and below contain a
sensitive data ...)
+ TODO: check
+CVE-2022-23156 (Wyse Device Agent version 14.6.1.4 and below contain an
Improper Authe ...)
+ TODO: check
+CVE-2022-23155 (Dell Wyse Management Suite versions 2.0 through 3.5.2 contain
an unres ...)
+ TODO: check
CVE-2022-23154
RESERVED
CVE-2022-23153
@@ -16028,16 +16052,15 @@ CVE-2022-22967
RESERVED
CVE-2022-22966
RESERVED
-CVE-2022-22965
- RESERVED
+CVE-2022-22965 (A Spring MVC or Spring WebFlux application running on JDK 9+
may be vu ...)
- libspring-java <unfixed>
[stretch] - libspring-java <end-of-life>
NOTE: https://bugalert.org/content/notices/2022-03-30-spring.html
NOTE: https://tanzu.vmware.com/security/cve-2022-22965
CVE-2022-22964
RESERVED
-CVE-2022-22963
- RESERVED
+CVE-2022-22963 (In Spring Cloud Function versions 3.1.6, 3.2.2 and older
unsupported v ...)
+ TODO: check
CVE-2022-22962
RESERVED
CVE-2022-22961
@@ -16062,8 +16085,8 @@ CVE-2022-22952 (VMware Carbon Black App Control (8.5.x
prior to 8.5.14, 8.6.x pr
NOT-FOR-US: VMware
CVE-2022-22951 (VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x
prior to ...)
NOT-FOR-US: VMware
-CVE-2022-22950
- RESERVED
+CVE-2022-22950 (n Spring Framework versions 5.3.0 - 5.3.16 and older
unsupported versi ...)
+ TODO: check
CVE-2022-22949
RESERVED
CVE-2022-22948 (The vCenter Server contains an information disclosure
vulnerability du ...)
@@ -17581,8 +17604,8 @@ CVE-2022-22572
RESERVED
CVE-2022-22571
RESERVED
-CVE-2022-22570
- RESERVED
+CVE-2022-22570 (A buffer overflow vulnerability found in the UniFi Door Access
Reader ...)
+ TODO: check
CVE-2022-22569
RESERVED
CVE-2022-22568
@@ -23005,8 +23028,8 @@ CVE-2022-21832
RESERVED
CVE-2022-21831
RESERVED
-CVE-2022-21830
- RESERVED
+CVE-2022-21830 (A blind self XSS vulnerability exists in RocketChat LiveChat
<v1.9 ...)
+ TODO: check
CVE-2022-21829
RESERVED
CVE-2022-21828 (A user with high privilege access to the Incapptic Connect web
console ...)
@@ -31097,7 +31120,7 @@ CVE-2021-42741
CVE-2021-42740 (The shell-quote package before 1.7.3 for Node.js allows
command inject ...)
- node-shell-quote 1.7.3+~1.7.1-1 (bug #998418)
NOTE:
https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe
(1.7.3)
-CVE-2021-42739 (The firewire subsystem in the Linux kernel through 5.14.13 has
a buffe ...)
+CVE-2021-42739 (A heap-based buffer overflow flaw was found in the Linux
kernel FireDT ...)
{DSA-5096-1 DLA-2941-1 DLA-2843-1}
- linux 5.14.16-1
[bullseye] - linux 5.10.84-1
@@ -34499,8 +34522,7 @@ CVE-2021-41833 (Zoho ManageEngine Patch Connect Plus
before 90099 is vulnerable
NOT-FOR-US: Zoho ManageEngine
CVE-2021-3848 (An arbitrary file creation by privilege escalation
vulnerability in Tr ...)
NOT-FOR-US: Trend Micro
-CVE-2021-3847 [low-privileged user privileges escalation]
- RESERVED
+CVE-2021-3847 (An unauthorized access to the execution of the setuid file with
capabi ...)
- linux <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2009704
NOTE: https://www.openwall.com/lists/oss-security/2021/10/14/3
@@ -39337,8 +39359,8 @@ CVE-2021-39910 (An issue has been discovered in GitLab
CE/EE affecting all versi
- gitlab <unfixed>
CVE-2021-39909 (Lack of email address ownership verification in the CODEOWNERS
feature ...)
- gitlab <not-affected> (Specific to EE)
-CVE-2021-39908
- RESERVED
+CVE-2021-39908 (In all versions of GitLab CE/EE, certain Unicode characters
can be abu ...)
+ TODO: check
CVE-2021-39907 (A potential DOS vulnerability was discovered in GitLab CE/EE
starting ...)
- gitlab <unfixed>
CVE-2021-39906 (Improper validation of ipynb files in GitLab CE/EE version
13.5 and ab ...)
@@ -54548,8 +54570,8 @@ CVE-2021-33659 (SAP 3D Visual Enterprise Viewer,
version - 9, allows a user to o
NOT-FOR-US: SAP
CVE-2021-33658 (atune before 0.3-0.8 log in as a local user and run the curl
command t ...)
NOT-FOR-US: A-Tune OS tuning engine
-CVE-2021-33657
- RESERVED
+CVE-2021-33657 (There is a heap overflow problem in video/SDL_pixels.c in SDL
(Simple ...)
+ TODO: check
CVE-2021-33656
RESERVED
CVE-2021-33655
@@ -56149,20 +56171,20 @@ CVE-2021-33026 (The Flask-Caching extension through
1.10.1 for Flask relies on P
NOTE: Negligible security impact
CVE-2021-33025
RESERVED
-CVE-2021-33024
- RESERVED
+CVE-2021-33024 (Philips Vue PACS versions 12.2.x.x and prior transmits or
stores authe ...)
+ TODO: check
CVE-2021-33023 (Advantech WebAccess versions 9.02 and prior are vulnerable to
a heap-b ...)
NOT-FOR-US: Advantech WebAccess
-CVE-2021-33022
- RESERVED
+CVE-2021-33022 (Philips Vue PACS versions 12.2.x.x and prior transmits
sensitive or se ...)
+ TODO: check
CVE-2021-33021
RESERVED
-CVE-2021-33020
- RESERVED
+CVE-2021-33020 (Philips Vue PACS versions 12.2.x.x and prior uses a
cryptographic key ...)
+ TODO: check
CVE-2021-33019 (A stack-based buffer overflow vulnerability in Delta
Electronics DOPSo ...)
NOT-FOR-US: Delta Electronics
-CVE-2021-33018
- RESERVED
+CVE-2021-33018 (The use of a broken or risky cryptographic algorithm in
Philips Vue PA ...)
+ TODO: check
CVE-2021-33017 (The standard access path of the IntelliBridge EC 40 and 60 Hub
(C.00.0 ...)
NOT-FOR-US: Philips
CVE-2021-33016
@@ -56245,24 +56267,24 @@ CVE-2021-32978
RESERVED
CVE-2021-32977
RESERVED
-CVE-2021-32976
- RESERVED
+CVE-2021-32976 (Five buffer overflows in the built-in web server in Moxa NPort
IAW5000 ...)
+ TODO: check
CVE-2021-32975 (Cscape (All Versions prior to 9.90 SP5) lacks proper
validation of use ...)
NOT-FOR-US: Cscape
-CVE-2021-32974
- RESERVED
+CVE-2021-32974 (Improper input validation in the built-in web server in Moxa
NPort IAW ...)
+ TODO: check
CVE-2021-32973
RESERVED
CVE-2021-32972 (Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an
attacke ...)
NOT-FOR-US: Panasonic
CVE-2021-32971 (Null pointer dereference in SuiteLink server while processing
command ...)
NOT-FOR-US: Suitelink
-CVE-2021-32970
- RESERVED
+CVE-2021-32970 (Data can be copied without validation in the built-in web
server in Mo ...)
+ TODO: check
CVE-2021-32969
RESERVED
-CVE-2021-32968
- RESERVED
+CVE-2021-32968 (Two buffer overflows in the built-in web server in Moxa NPort
IAW5000A ...)
+ TODO: check
CVE-2021-32967 (Delta Electronics DIAEnergie Version 1.7.5 and prior may allow
an atta ...)
NOT-FOR-US: Delta Electronics
CVE-2021-32966
@@ -56275,40 +56297,40 @@ CVE-2021-32963 (Null pointer dereference in SuiteLink
server while processing co
NOT-FOR-US: Suitelink
CVE-2021-32962
RESERVED
-CVE-2021-32961
- RESERVED
-CVE-2021-32960
- RESERVED
+CVE-2021-32961 (A getfile function in MDT AutoSave versions prior to v6.02.06
enables ...)
+ TODO: check
+CVE-2021-32960 (Rockwell Automation FactoryTalk Services Platform v6.11 and
earlier, i ...)
+ TODO: check
CVE-2021-32959 (Heap-based buffer overflow in SuiteLink server while
processing comman ...)
NOT-FOR-US: Suitelink
CVE-2021-32958
RESERVED
-CVE-2021-32957
- RESERVED
+CVE-2021-32957 (A function in MDT AutoSave versions prior to v6.02.06 is used
to retri ...)
+ TODO: check
CVE-2021-32956 (Advantech WebAccess/SCADA Versions 9.0.1 and prior is
vulnerable to re ...)
NOT-FOR-US: Advantech WebAccess/SCADA
CVE-2021-32955 (Delta Electronics DIAEnergie Version 1.7.5 and prior allows
unrestrict ...)
NOT-FOR-US: Delta Electronics
CVE-2021-32954 (Advantech WebAccess/SCADA Versions 9.0.1 and prior is
vulnerable to a ...)
NOT-FOR-US: Advantech WebAccess/SCADA
-CVE-2021-32953
- RESERVED
+CVE-2021-32953 (An attacker could utilize SQL commands to create a new user
MDT AutoSa ...)
+ TODO: check
CVE-2021-32952 (An out-of-bounds write issue exists in the DGN file-reading
procedure ...)
NOT-FOR-US: Open Design Alliance
CVE-2021-32951 (WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an
improper aut ...)
NOT-FOR-US: WebAccess/NMS
CVE-2021-32950 (An out-of-bounds read issue exists within the parsing of DXF
files in ...)
NOT-FOR-US: Open Design Alliance
-CVE-2021-32949
- RESERVED
+CVE-2021-32949 (An attacker could utilize a function in MDT AutoSave versions
prior to ...)
+ TODO: check
CVE-2021-32948 (An out-of-bounds write issue exists in the DWG file-reading
procedure ...)
NOT-FOR-US: Open Design Alliance
CVE-2021-32947 (FATEK Automation FvDesigner, Versions 1.5.88 and prior is
vulnerable t ...)
NOT-FOR-US: FATEK Automation FvDesigner
CVE-2021-32946 (An improper check for unusual or exceptional conditions issue
exists w ...)
NOT-FOR-US: Open Design Alliance
-CVE-2021-32945
- RESERVED
+CVE-2021-32945 (An attacker could decipher the encryption and gain access to
MDT AutoS ...)
+ TODO: check
CVE-2021-32944 (A use-after-free issue exists in the DGN file-reading
procedure in the ...)
NOT-FOR-US: Open Design Alliance
CVE-2021-32943 (The affected product is vulnerable to a stack-based buffer
overflow, w ...)
@@ -56323,16 +56345,16 @@ CVE-2021-32939 (FATEK Automation FvDesigner, Versions
1.5.88 and prior is vulner
NOT-FOR-US: FATEK Automation FvDesigner
CVE-2021-32938 (Drawings SDK (All versions prior to 2022.4) are vulnerable to
an out-o ...)
NOT-FOR-US: Open Design Alliance
-CVE-2021-32937
- RESERVED
+CVE-2021-32937 (An attacker can gain knowledge of a session temporary working
folder w ...)
+ TODO: check
CVE-2021-32936 (An out-of-bounds write issue exists in the DXF file-recovering
procedu ...)
NOT-FOR-US: Open Design Alliance
CVE-2021-32935
RESERVED
CVE-2021-32934
RESERVED
-CVE-2021-32933
- RESERVED
+CVE-2021-32933 (An attacker could leverage an API to pass along a malicious
file that ...)
+ TODO: check
CVE-2021-32932 (The affected product is vulnerable to a SQL injection, which
may allow ...)
NOT-FOR-US: Advantech
CVE-2021-32931 (An uninitialized pointer in FATEK Automation FvDesigner,
Versions 1.5. ...)
@@ -57522,8 +57544,8 @@ CVE-2021-32505
REJECTED
CVE-2021-32504
RESERVED
-CVE-2021-32503
- RESERVED
+CVE-2021-32503 (Unauthenticated users can access sensitive web URLs through
GET reques ...)
+ TODO: check
CVE-2021-32502
REJECTED
CVE-2021-32501
@@ -66663,8 +66685,7 @@ CVE-2021-29094 (Multiple buffer overflow
vulnerabilities when parsing a speciall
NOT-FOR-US: Esri (various ArcGIS products)
CVE-2021-29093 (A use-after-free vulnerability when parsing a specially
crafted file i ...)
NOT-FOR-US: Esri (various ArcGIS products)
-CVE-2021-3461
- RESERVED
+CVE-2021-3461 (A flaw was found in keycloak where keycloak may fail to logout
user se ...)
NOT-FOR-US: Keycloak
CVE-2021-29092 (Unrestricted upload of file with dangerous type vulnerability
in file ...)
NOT-FOR-US: Synology
@@ -68163,8 +68184,8 @@ CVE-2021-28506 (An issue has recently been discovered
in Arista EOS where certai
NOT-FOR-US: Arista
CVE-2021-28505
RESERVED
-CVE-2021-28504
- RESERVED
+CVE-2021-28504 (On Arista Strata family products which have “TCAM
profile” ...)
+ TODO: check
CVE-2021-28503 (The impact of this vulnerability is that Arista's EOS eAPI may
skip re ...)
NOT-FOR-US: Arista
CVE-2021-28502
@@ -70596,24 +70617,24 @@ CVE-2021-27503 (Ypsomed mylife Cloud, mylife Mobile
Application, Ypsomed mylife
NOT-FOR-US: Ypsomed
CVE-2021-27502
RESERVED
-CVE-2021-27501
- RESERVED
+CVE-2021-27501 (Philips Vue PACS versions 12.2.x.x and prior does not follow
certain c ...)
+ TODO: check
CVE-2021-27500
RESERVED
CVE-2021-27499 (Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed
mylife Cloud: ...)
NOT-FOR-US: Ypsomed
CVE-2021-27498
RESERVED
-CVE-2021-27497
- RESERVED
+CVE-2021-27497 (Philips Vue PACS versions 12.2.x.x and prior does not use or
incorrect ...)
+ TODO: check
CVE-2021-27496 (Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead,
Step3dRead, ...)
NOT-FOR-US: Datakit
CVE-2021-27495 (Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife
Cloud,A ...)
NOT-FOR-US: Ypsomed
CVE-2021-27494 (Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead,
Step3dRead, ...)
NOT-FOR-US: Datakit
-CVE-2021-27493
- RESERVED
+CVE-2021-27493 (Philips Vue PACS versions 12.2.x.x and prior does not ensure
or incorr ...)
+ TODO: check
CVE-2021-27492 (When opening a specially crafted 3DXML file, the application
containin ...)
NOT-FOR-US: Datakit
CVE-2021-27491 (Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife
Cloud,A ...)
@@ -71222,8 +71243,8 @@ CVE-2021-27225 (In Dataiku DSS before 8.0.6,
insufficient access control in the
NOT-FOR-US: Dataiku DSS
CVE-2021-27224 (The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a
user-mode write ...)
NOT-FOR-US: WPG plugin for IrfanView
-CVE-2021-27223
- RESERVED
+CVE-2021-27223 (A denial-of-service issue existed in one of modules that was
incorpora ...)
+ TODO: check
CVE-2021-27222 (In the "Time in Status" app before 4.13.0 for Jira, remote
authenticat ...)
NOT-FOR-US: "Time in Status" app
CVE-2021-27221 (** DISPUTED ** MikroTik RouterOS 6.47.9 allows remote
authenticated ft ...)
@@ -72681,10 +72702,10 @@ CVE-2021-26626
RESERVED
CVE-2021-26625
RESERVED
-CVE-2021-26624
- RESERVED
-CVE-2021-26623
- RESERVED
+CVE-2021-26624 (An local privilege escalation vulnerability due to a
"runasroot" comma ...)
+ TODO: check
+CVE-2021-26623 (A remote code execution vulnerability due to incomplete check
for 'xhe ...)
+ TODO: check
CVE-2021-26622 (An remote code execution vulnerability due to SSTI
vulnerability and i ...)
NOT-FOR-US: Genian NAC
CVE-2021-26621 (An Buffer Overflow vulnerability leading to remote code
execution was ...)
@@ -80858,10 +80879,10 @@ CVE-2021-23290
RESERVED
CVE-2021-23289
RESERVED
-CVE-2021-23288
- RESERVED
-CVE-2021-23287
- RESERVED
+CVE-2021-23288 (The vulnerability exists due to insufficient validation of
input from ...)
+ TODO: check
+CVE-2021-23287 (The vulnerability exists due to insufficient validation of
input of ce ...)
+ TODO: check
CVE-2021-23286
RESERVED
CVE-2021-23285
@@ -80942,8 +80963,8 @@ CVE-2021-23249
RESERVED
CVE-2021-23248
RESERVED
-CVE-2021-23247
- RESERVED
+CVE-2021-23247 (A command injection vulerability found in quick game engine
allows arb ...)
+ TODO: check
CVE-2021-23246 (In ACE2 ColorOS11, the attacker can obtain the foreground
package name ...)
NOT-FOR-US: ACE2 ColorOS11
CVE-2021-23245
@@ -83187,8 +83208,8 @@ CVE-2021-22279 (A Missing Authentication vulnerability
in RobotWare for the Omni
NOT-FOR-US: ABB / OmniCore robot controller
CVE-2021-22278 (A certificate validation vulnerability in PCM600 Update
Manager allows ...)
NOT-FOR-US: PCM600 Update Manager
-CVE-2021-22277
- RESERVED
+CVE-2021-22277 (Improper Input Validation vulnerability in ABB 800xA, Control
Software ...)
+ TODO: check
CVE-2021-22276 (The vulnerability allows a successful attacker to bypass the
integrity ...)
NOT-FOR-US: ABB
CVE-2021-22275
@@ -89590,8 +89611,7 @@ CVE-2021-20296 (A flaw was found in OpenEXR in versions
before 3.0.0-beta. A cra
[buster] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/b0c63c0b96eb9b0d3998f603e12f9f414fb0d44a
-CVE-2021-20295 [Regression of CVE-2020-10756 fix in virt:rhel/qemu-kvm in Red
Hat Enterprise Linux 8.3]
- RESERVED
+CVE-2021-20295 (It was discovered that the update for the virt:rhel module in
the RHSA ...)
- qemu <not-affected> (RHEL 8.3 specific security regression)
CVE-2021-20294 (A flaw was found in binutils readelf 2.35 program. An attacker
who is ...)
- binutils 2.35.2-1 (unimportant)
@@ -89858,8 +89878,7 @@ CVE-2021-20239 (A flaw was found in the Linux kernel in
versions before 5.4.92 i
[stretch] - linux <not-affected> (Vulnerable code introduced later)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-21-100/
NOTE: https://gist.github.com/Ga-ryo/2ec958e78f55c5d18558960f3fe1c6ec
-CVE-2021-20238
- RESERVED
+CVE-2021-20238 (It was found in OpenShift Container Platform 4 that ignition
config, s ...)
NOT-FOR-US: OpenShift
CVE-2021-20237 (An uncontrolled resource consumption (memory leak) flaw was
found in Z ...)
- zeromq3 4.3.3-1
@@ -106702,8 +106721,7 @@ CVE-2020-25693 (A flaw was found in CImg in versions
prior to 2.9.3. Integer ove
NOTE: https://github.com/dtschump/CImg/pull/295
NOTE: https://bugs.launchpad.net/ubuntu/+source/cimg/+bug/1900983
NOTE: Fixed by:
https://github.com/dtschump/CImg/commit/4f184f89f9ab6785a6c90fd238dbaa6d901d3505
-CVE-2020-25691
- RESERVED
+CVE-2020-25691 (A flaw was found in darkhttpd. Invalid error handling allows
remote at ...)
- darkhttpd <itp> (bug #775096)
CVE-2020-25690 (An out-of-bounds write flaw was found in FontForge in versions
before ...)
- fontforge <not-affected> (Insufficient patch for CVE-2020-5395 not
applied)
@@ -131859,8 +131877,8 @@ CVE-2020-14481 (The DeskLock tool provided with
FactoryTalk View SE uses a weak
NOT-FOR-US: FactoryTalk View SE
CVE-2020-14480 (Due to usernames/passwords being stored in plaintext in Random
Access ...)
NOT-FOR-US: Rockwell Automation
-CVE-2020-14479
- RESERVED
+CVE-2020-14479 (Sensitive information can be obtained through the handling of
serializ ...)
+ TODO: check
CVE-2020-14478 (A local, authenticated attacker could use an XML External
Entity (XXE) ...)
NOT-FOR-US: Rockwell Automation
CVE-2020-14477 (In Philips Ultrasound ClearVue Versions 3.2 and prior,
Ultrasound CX V ...)
@@ -184726,8 +184744,7 @@ CVE-2019-14841
NOT-FOR-US: Red Hat Decision Manager
CVE-2019-14840
RESERVED
-CVE-2019-14839
- RESERVED
+CVE-2019-14839 (It was observed that while login into Business-central
console, HTTP r ...)
NOT-FOR-US: Red Hat / JBoss BPMS Business-central console
CVE-2019-14838 (A flaw was found in wildfly-core before 7.2.5.GA. The
Management users ...)
- wildfly <itp> (bug #752018)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e52030bb297ed07b5d8a97451b60aa0a091afe12
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e52030bb297ed07b5d8a97451b60aa0a091afe12
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
