Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
729c2032 by Moritz Muehlenhoff at 2022-04-20T18:47:52+02:00
new gitlab issues
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1314,7 +1314,7 @@ CVE-2022-1296 (Out-of-bounds read in
`r_bin_ne_get_relocs` function in GitHub re
NOTE: https://huntr.dev/bounties/52b57274-0e1a-4d61-ab29-1373b555fea0
NOTE:
https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6
CVE-2022-1295 (Prototype Pollution in GitHub repository
alvarotrigo/fullpage.js prior ...)
- TODO: check
+ NOT-FOR-US: fullpage.js
CVE-2022-1294
RESERVED
CVE-2022-1293
@@ -1599,9 +1599,9 @@ CVE-2022-28892
CVE-2022-28891
RESERVED
CVE-2022-27629 (Cross-site request forgery (CSRF) vulnerability in
'MicroPayments - Pa ...)
- TODO: check
+ NOT-FOR-US: MicroPayments - Paid Author Subscriptions, Content,
Downloads, Membership
CVE-2022-1291 (XSS vulnerability with default `onCellHtmlData` function in
GitHub rep ...)
- TODO: check
+ NOT-FOR-US: Trudesk
CVE-2022-1290 (Stored XSS in "Name", "Group Name" & "Title" in GitHub
repository ...)
NOT-FOR-US: Trudesk
CVE-2022-1289 (A denial of service vulnerability was found in tildearrow
Furnace. It ...)
@@ -2090,7 +2090,7 @@ CVE-2022-1280 (A use-after-free vulnerability was found
in drm_lease_held in dri
- linux <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2022/04/12/3
CVE-2022-1279 (A vulnerability in the encryption implementation of EBICS
messages in ...)
- TODO: check
+ NOT-FOR-US: ebics-java
CVE-2022-1278
RESERVED
CVE-2022-1277
@@ -3628,7 +3628,7 @@ CVE-2022-1158
NOTE:
https://git.kernel.org/linus/2a8859f373b0a86f0ece8ec8312607eacf12485d (5.18-rc1)
NOTE: https://www.openwall.com/lists/oss-security/2022/04/08/4
CVE-2022-1157 (Missing sanitization of logged exception messages in all
versions prio ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2022-1156
RESERVED
CVE-2022-1155 (Old sessions are not blocked by the login enable function. in
GitHub r ...)
@@ -3932,9 +3932,9 @@ CVE-2022-28111
CVE-2022-28110
RESERVED
CVE-2022-28109 (Selenium Selenium Grid (formerly Selenium Standalone Server)
Fixed in ...)
- TODO: check
+ NOT-FOR-US: Selenium
CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits
non-JSO ...)
- TODO: check
+ NOT-FOR-US: Selenium
CVE-2022-28107
RESERVED
CVE-2022-28106
@@ -4333,7 +4333,7 @@ CVE-2022-1104
CVE-2022-1103
RESERVED
CVE-2022-27927 (A SQL injection vulnerability exists in Microfinance
Management System ...)
- TODO: check
+ NOT-FOR-US: Microfinance Management System
CVE-2022-27926
RESERVED
CVE-2022-27925
@@ -4557,9 +4557,9 @@ CVE-2022-1068 (Modbus Tools Modbus Slave (versions 7.4.2
and prior) is vulnerabl
CVE-2022-1067 (Navigating to a specific URL with a patient ID number will
result in t ...)
NOT-FOR-US: LifePoint Informatics Patient Portal
CVE-2022-27863 (Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel
Booking ...)
- TODO: check
+ NOT-FOR-US: Vikbooking
CVE-2022-27862 (Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel
Booking ...)
- TODO: check
+ NOT-FOR-US: Vikbooking
CVE-2022-27861
RESERVED
CVE-2022-27860
@@ -4599,7 +4599,7 @@ CVE-2022-27844 (Arbitrary File Read vulnerability in
WPvivid Team Migration, Bac
CVE-2022-1066
RESERVED
CVE-2022-1065 (A vulnerability within the authentication process of Abacus ERP
allows ...)
- TODO: check
+ NOT-FOR-US: Abacus ERP
CVE-2022-1064 (SQL injection through marking blog comments on bulk as spam in
GitHub ...)
NOT-FOR-US: forkcms
CVE-2022-1063 (The Thank Me Later WordPress plugin through 3.3.4 does not
sanitise an ...)
@@ -5218,9 +5218,9 @@ CVE-2022-27580
CVE-2022-27579
RESERVED
CVE-2022-27578 (An attacker can perform a privilege escalation through the
SICK OEE if ...)
- TODO: check
+ NOT-FOR-US: SICK
CVE-2022-27577 (The vulnerability in the MSC800 in all versions before 4.15
allows for ...)
- TODO: check
+ NOT-FOR-US: SICK
CVE-2022-27576 (Information exposure vulnerability in Samsung DeX Home prior
to SMR Ap ...)
NOT-FOR-US: Samsung
CVE-2022-27575 (Information exposure vulnerability in One UI Home prior to SMR
April-2 ...)
@@ -5324,7 +5324,7 @@ CVE-2022-27529 (A maliciously crafted PICT, BMP, PSD or
TIF file in Autodesk Aut
CVE-2022-27528 (A maliciously crafted DWFX and SKP files in Autodesk
Navisworks 2022 c ...)
NOT-FOR-US: Autodesk
CVE-2022-27527 (A Memory Corruption vulnerability may lead to code execution
through m ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27526 (A malicious crafted TGA file when consumed through
DesignReview.exe ap ...)
NOT-FOR-US: Autodesk
CVE-2022-27525 (A malicious crafted .dwf file when consumed through
DesignReview.exe a ...)
@@ -5973,9 +5973,9 @@ CVE-2022-27264
CVE-2022-27263 (An arbitrary file upload vulnerability in the file upload
module of St ...)
NOT-FOR-US: Strapi
CVE-2022-27262 (An arbitrary file upload vulnerability in the file upload
module of Sk ...)
- TODO: check
+ NOT-FOR-US: Skipper
CVE-2022-27261 (An arbitrary file write vulnerability in Express-FileUpload
v1.3.1 all ...)
- TODO: check
+ NOT-FOR-US: Express-FileUpload
CVE-2022-27260 (An arbitrary file upload vulnerability in the file upload
component of ...)
NOT-FOR-US: ButterCMS
CVE-2022-27259
@@ -6099,7 +6099,7 @@ CVE-2022-26349 (Delta Electronics DIAEnergie (All
versions prior to 1.8.02.004)
CVE-2022-25880 (Delta Electronics DIAEnergie (All versions prior to
1.8.02.004) has a ...)
NOT-FOR-US: Delta Electronics
CVE-2022-1019 (Automated Logic's WebCtrl Server Version 6.1 'Help' index pages
are vu ...)
- TODO: check
+ NOT-FOR-US: Automated Logic WebCtrl Server
CVE-2022-1018 (When opening a malicious solution file provided by an attacker,
the ap ...)
NOT-FOR-US: Rockwell Automation
CVE-2022-27172
@@ -6574,9 +6574,9 @@ CVE-2022-27142
CVE-2022-27141
RESERVED
CVE-2022-27140 (An arbitrary file upload vulnerability in the file upload
module of Ex ...)
- TODO: check
+ NOT-FOR-US: Express FileUpload
CVE-2022-27139 (An arbitrary file upload vulnerability in the file upload
module of Gh ...)
- TODO: check
+ NOT-FOR-US: Ghost CMS
CVE-2022-27138
RESERVED
CVE-2022-27137
@@ -6646,7 +6646,7 @@ CVE-2022-27106
CVE-2022-27105
RESERVED
CVE-2022-27104 (An Unauthenticated time-based blind SQL injection
vulnerability exists ...)
- TODO: check
+ NOT-FOR-US: Forma LMS
CVE-2022-27103
RESERVED
CVE-2022-27102
@@ -6744,7 +6744,7 @@ CVE-2022-27057
CVE-2022-27056
RESERVED
CVE-2022-27055 (** DISPUTED ** ecjia-daojia 1.38.1-20210202629 is vulnerable
to inform ...)
- TODO: check
+ NOT-FOR-US: ecjia-daojia
CVE-2022-27054
RESERVED
CVE-2022-27053
@@ -7083,9 +7083,9 @@ CVE-2022-26913
CVE-2022-26912 (Microsoft Edge (Chromium-based) Elevation of Privilege
Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-26911 (Skype for Business Information Disclosure Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-26910 (Skype for Business and Lync Spoofing Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-26909 (Microsoft Edge (Chromium-based) Elevation of Privilege
Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-26908 (Microsoft Edge (Chromium-based) Elevation of Privilege
Vulnerability. ...)
@@ -7285,7 +7285,7 @@ CVE-2022-26848
CVE-2022-26843
RESERVED
CVE-2022-26832 (.NET Framework Denial of Service Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-26831 (Windows LDAP Denial of Service Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-26830 (DiskUsage.exe Remote Code Execution Vulnerability. ...)
@@ -7896,11 +7896,11 @@ CVE-2022-26597
CVE-2022-26596
RESERVED
CVE-2022-26595 (Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2
fix pack 1 ...)
- TODO: check
+ NOT-FOR-US: Liferay
CVE-2022-26594 (Multiple cross-site scripting (XSS) vulnerabilities in Liferay
Portal ...)
NOT-FOR-US: Liferay
CVE-2022-26593 (Cross-site scripting (XSS) vulnerability in the Asset module's
asset c ...)
- TODO: check
+ NOT-FOR-US: Liferay
CVE-2022-26592
RESERVED
CVE-2022-26591 (FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows
unauthenticated attac ...)
@@ -9406,7 +9406,7 @@ CVE-2022-26094 (Null pointer dereference vulnerability in
parser_auxC function i
CVE-2022-26093 (Null pointer dereference vulnerability in parser_irot function
in libs ...)
NOT-FOR-US: Samsung
CVE-2022-26092 (Improper boundary check in Quram Agif library prior to SMR
Apr-2022 Re ...)
- TODO: check
+ NOT-FOR-US: Samsung
CVE-2022-26091 (Improper access control vulnerability in Knox Manage prior to
SMR Apr- ...)
NOT-FOR-US: Samsung
CVE-2022-26090 (Improper access control vulnerability in SamsungContacts prior
to SMR ...)
@@ -9971,9 +9971,9 @@ CVE-2022-25835
CVE-2022-25834
RESERVED
CVE-2022-25833 (Improper authentication in ImsService prior to SMR Apr-2022
Release 1 ...)
- TODO: check
+ NOT-FOR-US: Samsung
CVE-2022-25832 (Improper authentication vulnerability in S Secure prior to SMR
Apr-202 ...)
- TODO: check
+ NOT-FOR-US: Samsung
CVE-2022-25831 (Improper access control vulnerability in S Secure prior to SMR
Apr-202 ...)
NOT-FOR-US: Samsung
CVE-2022-25830 (Information Exposure vulnerability in Galaxy Watch3 Plugin
prior to ve ...)
@@ -10098,7 +10098,7 @@ CVE-2022-25790 (A maliciously crafted DWF file in
Autodesk AutoCAD 2022, 2021, 2
CVE-2022-25789 (A maliciously crafted DWF, 3DS and DWFX files in Autodesk
AutoCAD 2022 ...)
NOT-FOR-US: Autodesk
CVE-2022-25788 (A maliciously crafted JT file in Autodesk AutoCAD 2022 may be
used to ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-25787
RESERVED
CVE-2022-25786
@@ -11677,7 +11677,7 @@ CVE-2022-25228
CVE-2022-25227
RESERVED
CVE-2022-25226 (ThinVNC version 1.0b1 allows an unauthenticated user to bypass
the aut ...)
- TODO: check
+ NOT-FOR-US: ThinVNC
CVE-2022-25225 (Network Olympus version 1.8.0 allows an authenticated admin
user to in ...)
NOT-FOR-US: Network Olympus
CVE-2022-25224
@@ -12698,7 +12698,7 @@ CVE-2022-24862
CVE-2022-24861
RESERVED
CVE-2022-24860 (Databasir is a team-oriented relational database model
document manage ...)
- TODO: check
+ NOT-FOR-US: Databasir
CVE-2022-24859 (PyPDF2 is an open source python PDF library capable of
splitting, merg ...)
- pypdf2 <unfixed> (bug #1009879)
NOTE:
https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79
@@ -12727,7 +12727,7 @@ CVE-2022-24851 (LDAP Account Manager (LAM) is an open
source web frontend for ma
CVE-2022-24850 (Discourse is an open source platform for community discussion.
A categ ...)
NOT-FOR-US: Discourse
CVE-2022-24849 (DisCatSharp is a Discord API wrapper for .NET. Users of
versions 9.8.5 ...)
- TODO: check
+ NOT-FOR-US: DisCatSharp
CVE-2022-24848
RESERVED
CVE-2022-24847 (GeoServer is an open source software server written in Java
that allow ...)
@@ -12737,9 +12737,9 @@ CVE-2022-24846 (GeoWebCache is a tile caching server
implemented in Java. The Ge
CVE-2022-24845 (Vyper is a pythonic Smart Contract Language for the ethereum
virtual m ...)
TODO: check
CVE-2022-24844 (Gin-vue-admin is a backstage management system based on vue
and gin, w ...)
- TODO: check
+ NOT-FOR-US: Gin-vue-admin
CVE-2022-24843 (Gin-vue-admin is a backstage management system based on vue
and gin, w ...)
- TODO: check
+ NOT-FOR-US: Gin-vue-admin
CVE-2022-24842 (MinIO is a High Performance Object Storage released under GNU
Affero G ...)
NOT-FOR-US: MinIO
CVE-2022-24841 (fleetdm/fleet is an open source device management, built on
osquery. A ...)
@@ -15691,9 +15691,9 @@ CVE-2022-23978
CVE-2022-23977
RESERVED
CVE-2022-23976 (Cross-Site Request Forgery (CSRF) in Access Demo Importer
<= 1.0.7 ...)
- TODO: check
+ NOT-FOR-US: Access Demo Importer
CVE-2022-23975 (Cross-Site Request Forgery (CSRF) in Access Demo Importer
<= 1.0.7 ...)
- TODO: check
+ NOT-FOR-US: Access Demo Importer
CVE-2022-23974 (In 0.9.3 or older versions of Apache Pinot segment upload path
allowed ...)
NOT-FOR-US: Apache Pinot
CVE-2022-23103
@@ -15723,7 +15723,7 @@ CVE-2022-0375 (Cross-site Scripting (XSS) - Stored in
Packagist remdex/livehelpe
CVE-2022-0374 (Cross-site Scripting (XSS) - Stored in Packagist
remdex/livehelperchat ...)
NOT-FOR-US: livehelperchat
CVE-2022-0373 (Improper access control in GitLab CE/EE versions 12.4 to
14.5.4, 14.5 ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2022-0372 (Cross-site Scripting (XSS) - Stored in Packagist
bytefury/crater prior ...)
NOT-FOR-US: Crater
CVE-2021-46561 (controller/org.controller/org.controller.js in the CVE
Services API 1. ...)
@@ -15909,7 +15909,7 @@ CVE-2022-23939
CVE-2022-23938
RESERVED
CVE-2022-23937 (In Wind River VxWorks 6.9 and 7, a specific crafted packet may
lead to ...)
- TODO: check no mention of this CVE at windriver.com urls
+ NOT-FOR-US: Wind River
CVE-2022-23936
RESERVED
CVE-2022-23935 (lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a
$file =~ / ...)
@@ -15975,7 +15975,7 @@ CVE-2022-23911 (The Testimonial WordPress Plugin
WordPress plugin before 1.4.7 d
CVE-2022-23910
RESERVED
CVE-2022-23909 (There is an unquoted service path in Sherpa Connector Service
(SherpaC ...)
- TODO: check
+ NOT-FOR-US: Sherpa Connector Service
CVE-2022-23908
RESERVED
CVE-2022-23907 (CMS Made Simple v2.2.15 was discovered to contain a reflected
cross-si ...)
@@ -15997,7 +15997,7 @@ CVE-2022-23901 (A stack overflow re2c 2.2 exists due to
infinite recursion issue
NOTE:
https://github.com/skvadrik/re2c/commit/039c18949190c5de5397eba504d2c75dad2ea9ca
(3.0)
NOTE: Crash im CLI tool, no security impact
CVE-2022-23900 (A command injection vulnerability in the API of the Wavlink
WL-WN531P3 ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2022-23899 (MCMS v5.2.5 was discovered to contain a SQL injection
vulnerability vi ...)
NOT-FOR-US: MCMS
CVE-2022-23898 (MCMS v5.2.5 was discovered to contain a SQL injection
vulnerability vi ...)
@@ -16067,7 +16067,7 @@ CVE-2022-23867
CVE-2022-23866
RESERVED
CVE-2022-23865 (Nyron 1.0 is affected by a SQL injection vulnerability through
Nyron/L ...)
- TODO: check
+ NOT-FOR-US: Nyron
CVE-2022-0352 (Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior
to 0.6 ...)
NOT-FOR-US: calibre-web
CVE-2022-0351 (Access of Memory Location Before Start of Buffer in GitHub
repository ...)
@@ -16869,7 +16869,7 @@ CVE-2022-23734
CVE-2022-23733
RESERVED
CVE-2022-23732 (A path traversal vulnerability was identified in GitHub
Enterprise Ser ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2022-23731 (V8 javascript engine (heap vulnerability) can cause privilege
escalati ...)
NOT-FOR-US: LG
CVE-2022-23730 (The public API error causes for the attacker to be able to
bypass API ...)
@@ -16927,19 +16927,19 @@ CVE-2022-23705
CVE-2022-23704
RESERVED
CVE-2022-23703 (A security vulnerability has been identified in HPE Nimble
Storage Hyb ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23702 (A potential security vulnerability has been identified in HPE
Superdom ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23701 (A potential remote host header injection security
vulnerability has be ...)
NOT-FOR-US: HPE
CVE-2022-23700 (A local unauthorized read access to files vulnerability was
discovered ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23699 (A local authentication restriction bypass vulnerability was
discovered ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23698 (A remote unauthenticated disclosure of information
vulnerability was d ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23697 (A remote cross-site scripting (xss) vulnerability was
discovered in HP ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2022-23696
RESERVED
CVE-2022-23695
@@ -17513,7 +17513,7 @@ CVE-2022-23448 (A vulnerability has been identified in
SIMATIC Energy Manager Ba
CVE-2022-23447
RESERVED
CVE-2022-23446 (A improper control of a resource through its lifetime in
Fortinet Fort ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2022-23445
RESERVED
CVE-2022-23444
@@ -17523,9 +17523,9 @@ CVE-2022-23443
CVE-2022-23442
RESERVED
CVE-2022-23441 (A use of hard-coded cryptographic key vulnerability [CWE-321]
in Forti ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2022-23440 (A use of hard-coded cryptographic key vulnerability [CWE-321]
in the r ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2022-23439
RESERVED
CVE-2022-23438
@@ -18272,7 +18272,7 @@ CVE-2022-0251 (Cross-site Scripting (XSS) - Stored in
GitHub repository pimcore/
CVE-2022-0250
RESERVED
CVE-2022-0249 (A vulnerability was discovered in GitLab starting with version
12. Git ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2022-0248 (The Contact Form Submissions WordPress plugin before 1.7.3 does
not sa ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0247 (An issue exists in Fuchsia where VMO data can be modified
through acce ...)
@@ -18349,7 +18349,7 @@ CVE-2022-23294 (Windows Event Tracing Remote Code
Execution Vulnerability. ...)
CVE-2022-23293 (Windows Fast FAT File System Driver Elevation of Privilege
Vulnerabili ...)
NOT-FOR-US: Microsoft
CVE-2022-23292 (Microsoft Power BI Spoofing Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-23291 (Windows DWM Core Library Elevation of Privilege Vulnerability.
This CV ...)
NOT-FOR-US: Microsoft
CVE-2022-23290 (Windows Inking COM Elevation of Privilege Vulnerability. ...)
@@ -18397,7 +18397,7 @@ CVE-2022-23270
CVE-2022-23269 (Microsoft Dynamics GP Spoofing Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-23268 (Windows Hyper-V Denial of Service Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-23267
RESERVED
CVE-2022-23266 (Microsoft Defender for IoT Elevation of Privilege
Vulnerability. ...)
@@ -18415,11 +18415,11 @@ CVE-2022-23261 (Microsoft Edge (Chromium-based)
Tampering Vulnerability. ...)
CVE-2022-23260
RESERVED
CVE-2022-23259 (Microsoft Dynamics 365 (on-premises) Remote Code Execution
Vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-23258 (Microsoft Edge for Android Spoofing Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-23257 (Windows Hyper-V Remote Code Execution Vulnerability. This CVE
ID is un ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-23256 (Azure Data Explorer Spoofing Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-23255 (Microsoft OneDrive for Android Security Feature Bypass
Vulnerability. ...)
@@ -19299,11 +19299,11 @@ CVE-2022-22989 (My Cloud OS 5 was vulnerable to a
pre-authenticated stack overfl
CVE-2022-22988 (File and directory permissions have been corrected to prevent
unintend ...)
NOT-FOR-US: Western Digital
CVE-2022-21234 (An SQL injection vulnerability exists in the EchoAssets.aspx
functiona ...)
- TODO: check
+ NOT-FOR-US: Lansweeper
CVE-2022-21210 (An SQL injection vulnerability exists in the AssetActions.aspx
functio ...)
- TODO: check
+ NOT-FOR-US: Lansweeper
CVE-2022-21145 (A stored cross-site scripting vulnerability exists in the
WebUserActio ...)
- TODO: check
+ NOT-FOR-US: Lansweeper
CVE-2022-0182 (Stored cross-site scripting vulnerability in Quiz And Survey
Master ve ...)
NOT-FOR-US: Quiz And Survey Master
CVE-2022-0181 (Reflected cross-site scripting vulnerability in Quiz And Survey
Master ...)
@@ -20564,7 +20564,7 @@ CVE-2022-0138 (MMP: All versions prior to v1.0.3, PTP
C-series: Device versions
CVE-2022-0137
RESERVED
CVE-2022-0136 (A vulnerability was discovered in GitLab versions 10.5 to
14.5.4, 14.6 ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2022-0135 [out-of-bounds write in read_transfer_data()]
RESERVED
- virglrenderer <unfixed> (bug #1009073)
@@ -20691,7 +20691,7 @@ CVE-2022-0125 (An issue has been discovered in GitLab
affecting all versions sta
CVE-2022-0124 (An issue has been discovered affecting GitLab versions prior to
14.4.5 ...)
- gitlab <unfixed>
CVE-2022-0123 (An issue has been discovered affecting GitLab versions prior to
14.4.5 ...)
- TODO: check
+ - gitlab <unfixed>
CVE-2021-4200
RESERVED
CVE-2022-22677
@@ -20933,9 +20933,9 @@ CVE-2022-22574
CVE-2022-22573
RESERVED
CVE-2022-22572 (A non-admin user with user management permission can escalate
his priv ...)
- TODO: check
+ NOT-FOR-US: Incapptic
CVE-2022-22571 (An authenticated high privileged user can perform a stored XSS
attack ...)
- TODO: check
+ NOT-FOR-US: Incapptic
CVE-2022-22570 (A buffer overflow vulnerability found in the UniFi Door Access
Reader ...)
NOT-FOR-US: UniFi Door Access Reader Lite
CVE-2022-22569
@@ -21225,19 +21225,19 @@ CVE-2022-22521
CVE-2022-22520
RESERVED
CVE-2022-22519 (A remote, authenticated attacker can send a specific crafted
HTTP or H ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22518 (A bug in CmpUserMgr component can lead to only partially
applied secur ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22517 (An unauthenticated, remote attacker can disrupt existing
communication ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22516 (The SysDrv3S driver in the CODESYS Control runtime system on
Microsoft ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22515 (A remote, unauthenticated attacker could utilize the control
programme ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22514 (An authenticated, remote attacker can gain access to a
dereferenced po ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22513 (An authenticated remote attacker can cause a null pointer
dereference ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2022-22512
RESERVED
CVE-2022-22511 (Various configuration pages of the device are vulnerable to
reflected ...)
@@ -22356,7 +22356,7 @@ CVE-2022-22281
CVE-2022-22280
RESERVED
CVE-2022-22279 (** UNSUPPORTED WHEN ASSIGNED ** A post-authentication
arbitrary file r ...)
- TODO: check
+ NOT-FOR-US: Sonicwall
CVE-2022-22278
RESERVED
CVE-2022-22277
@@ -30304,23 +30304,23 @@ CVE-2022-21492 (Vulnerability in the Oracle Business
Intelligence Enterprise Edi
CVE-2022-21491 (Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualiza ...)
- virtualbox <unfixed>
CVE-2022-21490 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21489 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21488 (Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualiza ...)
- virtualbox <unfixed>
CVE-2022-21487 (Vulnerability in the Oracle VM VirtualBox product of Oracle
Virtualiza ...)
- virtualbox <unfixed>
CVE-2022-21486 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21485 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21484 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21483 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21482 (Vulnerability in the MySQL Cluster product of Oracle MySQL
(component: ...)
- TODO: check
+ NOT-FOR-US: MySQL Cluster
CVE-2022-21481 (Vulnerability in the PeopleSoft Enterprise FIN Cash Management
product ...)
NOT-FOR-US: Oracle
CVE-2022-21480 (Vulnerability in the Oracle Transportation Management product
of Oracl ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/729c20321c16cc4a3ee7afd2f5fe34c7947ea5e8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/729c20321c16cc4a3ee7afd2f5fe34c7947ea5e8
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
