Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7de836b2 by Salvatore Bonaccorso at 2022-05-16T22:24:48+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1088,7 +1088,7 @@ CVE-2022-1643
CVE-2022-30524 (There is an invalid memory access in the TextLine class in
TextOutputD ...)
- xpdf <not-affected> (Debian uses poppler, which is not affected)
CVE-2022-30523 (Trend Micro Password Manager (Consumer) version 5.0.0.1266 and
below i ...)
- TODO: check
+ NOT-FOR-US: Trend Micro
CVE-2022-30522
RESERVED
CVE-2022-1642
@@ -2183,13 +2183,13 @@ CVE-2022-1562
CVE-2022-1561
RESERVED
CVE-2022-1560 (The Amministrazione Aperta WordPress plugin through 3.7.3 does
not val ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1559 (The Clipr WordPress plugin through 1.2.3 does not sanitise and
escape ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1558
RESERVED
CVE-2022-1557 (The ULeak Security & Monitoring WordPress plugin through
1.2.3 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1556
RESERVED
CVE-2022-1555 (DOM XSS in microweber ver 1.2.15 in GitHub repository
microweber/micro ...)
@@ -2903,7 +2903,7 @@ CVE-2022-1514 (Stored XSS via upload plugin functionality
in zip format in GitHu
CVE-2022-1513
RESERVED
CVE-2022-1512 (The ScrollReveal.js Effects WordPress plugin through 1.2 does
not sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1511 (Improper Access Control in GitHub repository snipe/snipe-it
prior to 5 ...)
- snipe-it <itp> (bug #1005172)
CVE-2022-1510 (An issue has been discovered in GitLab affecting all versions
starting ...)
@@ -3292,7 +3292,7 @@ CVE-2022-29789 (The HiAIserver has a vulnerability in
verifying the validity of
CVE-2022-27174
RESERVED
CVE-2022-1465 (The WPC Smart Wishlist for WooCommerce WordPress plugin before
2.9.9 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1464 (Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7.
As the ...)
NOT-FOR-US: Go Git Service
CVE-2022-1463 (The Booking Calendar plugin for WordPress is vulnerable to PHP
Object ...)
@@ -3700,7 +3700,7 @@ CVE-2022-29601
CVE-2022-29600
RESERVED
CVE-2022-1455 (The Call Now Button WordPress plugin before 1.1.2 does not
escape a pa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1454
RESERVED
CVE-2022-1453 (The RSVPMaker plugin for WordPress is vulnerable to
unauthenticated SQ ...)
@@ -3794,9 +3794,9 @@ CVE-2022-1437 (Heap-based Buffer Overflow in GitHub
repository radareorg/radare2
NOTE: https://huntr.dev/bounties/af6c3e9e-b7df-4d80-b48f-77fdd17b4038
NOTE:
https://github.com/radareorg/radare2/commit/669a404b6d98d5db409a5ebadae4e94b34ef5136
CVE-2022-1436 (The WPCargo Track & Trace WordPress plugin before 6.9.5
does not s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1435 (The WPCargo Track & Trace WordPress plugin before 6.9.5
does not s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1434 (The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly ...)
[experimental] - openssl 3.0.3-1
- openssl <not-affected> (Only affects OpenSSL 3.0)
@@ -3870,7 +3870,7 @@ CVE-2022-29560
CVE-2022-1426 (An issue has been discovered in GitLab affecting all versions
starting ...)
TODO: check
CVE-2022-1425 (The WPQA Builder Plugin WordPress plugin before 5.2, used as a
compani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1424
RESERVED
CVE-2022-1423
@@ -3966,7 +3966,7 @@ CVE-2022-1419
NOTE: https://www.openwall.com/lists/oss-security/2022/04/21/1
NOTE: Fixed by:
https://git.kernel.org/linus/4b848f20eda5974020f043ca14bacf7a7e634fc8 (5.6-rc2)
CVE-2022-1418 (The Social Stickers WordPress plugin through 2.2.9 does not
have CSRF ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-29527 (Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a
world-writable ...)
NOT-FOR-US: Amazon AWS amazon-ssm-agent
CVE-2022-29526
@@ -4000,11 +4000,11 @@ CVE-2022-1411 (Unrestructed file upload in GitHub
repository yetiforcecompany/ye
CVE-2022-1410
RESERVED
CVE-2022-1409 (The VikBooking Hotel Booking Engine & PMS WordPress plugin
before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1408 (The VikBooking Hotel Booking Engine & PMS WordPress plugin
before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1407 (The VikBooking Hotel Booking Engine & PMS WordPress plugin
before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-29510
RESERVED
CVE-2022-29505 (Due to build misconfiguration in openssl dependency, LINE for
Windows ...)
@@ -4048,7 +4048,7 @@ CVE-2022-1400
CVE-2022-1399
RESERVED
CVE-2022-1398 (The External Media without Import WordPress plugin through
1.1.2 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1397 (API Privilege Escalation in GitHub repository
alextselegidis/easyappoi ...)
NOT-FOR-US: alextselegidis/easyappointments
CVE-2022-1396 (The Donorbox WordPress plugin before 7.1.7 does not sanitise
and escap ...)
@@ -4058,7 +4058,7 @@ CVE-2022-1395
CVE-2022-1394
RESERVED
CVE-2022-1393 (The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle
field an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1392 (The Videos sync PDF WordPress plugin through 1.7.4 does not
validate t ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1391 (The Cab fare calculator WordPress plugin through 1.0.3 does not
valida ...)
@@ -4309,7 +4309,7 @@ CVE-2022-27632
CVE-2022-1387
RESERVED
CVE-2022-1386 (The Fusion Builder WordPress plugin before 3.6.2, used in the
Avada th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-29405
RESERVED
CVE-2022-1385 (Mattermost 6.4.x and earlier fails to properly invalidate
pending emai ...)
@@ -4708,7 +4708,7 @@ CVE-2022-1350 (A vulnerability classified as problematic
was found in GhostPCL 9
NOTE: Issue is in GhostPCL sourcewise shipped in src:ghostscript
NOTE: Upstream report is as per 2022-04-15 not yet public
CVE-2022-1349 (The WPQA Builder Plugin WordPress plugin before 5.2, used as a
compani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1348
RESERVED
CVE-2022-1347 (Stored XSS in the "Username" & "Email" input fields leads
to accou ...)
@@ -4960,7 +4960,7 @@ CVE-2022-1336
CVE-2022-1335
RESERVED
CVE-2022-1334 (The WP YouTube Live WordPress plugin before 1.8.3 does not
validate, s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1333 (Mattermost Playbooks plugin v1.24.0 and earlier fails to
properly chec ...)
NOT-FOR-US: Mattermost Playbooks plugin
CVE-2015-20107 (In Python (aka CPython) through 3.10.4, the mailcap module
does not ad ...)
@@ -6219,11 +6219,11 @@ CVE-2022-1269 (The Fast Flow WordPress plugin before
1.2.11 does not sanitise an
CVE-2022-1268
RESERVED
CVE-2022-1267 (The BMI BMR Calculator WordPress plugin through 1.3 does not
sanitise ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1266
RESERVED
CVE-2022-1265 (The BulletProof Security WordPress plugin before 6.1 does not
sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1264
RESERVED
CVE-2022-1262 (A command injection vulnerability in the protest binary allows
an atta ...)
@@ -6478,9 +6478,9 @@ CVE-2022-1219 (SQL injection in RecyclebinController.php
in GitHub repository pi
CVE-2022-1218
RESERVED
CVE-2022-1217 (The Custom TinyMCE Shortcode Button WordPress plugin through
1.1 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1216 (The Advanced Image Sitemap WordPress plugin through 1.2 does
not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1215
RESERVED
- libinput 1.20.1-1
@@ -7558,7 +7558,7 @@ CVE-2022-1184
CVE-2022-1183
RESERVED
CVE-2022-1182 (The Visual Slide Box Builder WordPress plugin through 3.2.9
does not s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1181 (Stored Cross Site Scripting in GitHub repository
openemr/openemr prior ...)
NOT-FOR-US: OpenEMR
CVE-2022-1180 (Reflected Cross Site Scripting in GitHub repository
openemr/openemr pr ...)
@@ -8488,7 +8488,7 @@ CVE-2022-1105 (An improper access control vulnerability
in GitLab CE/EE affectin
CVE-2022-1104 (The Popup Maker WordPress plugin before 1.16.5 does not
sanitise and e ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1103 (The Advanced Uploader WordPress plugin through 4.2 allows any
authenti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-27927 (A SQL injection vulnerability exists in Microfinance
Management System ...)
NOT-FOR-US: Microfinance Management System
CVE-2022-27926 (A reflected cross-site scripting (XSS) vulnerability in the
/public/la ...)
@@ -8661,7 +8661,7 @@ CVE-2022-1091 (The sanitisation step of the Safe SVG
WordPress plugin before 1.9
CVE-2022-1090 (The Good & Bad Comments WordPress plugin through 1.0.0 does
not sa ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1089 (The Bulk Edit and Create User Profiles WordPress plugin before
1.5.14 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1088 (The Page Security & Membership WordPress plugin through
1.5.15 doe ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1087 (A vulnerability, which was classified as problematic, has been
found i ...)
@@ -8762,7 +8762,7 @@ CVE-2022-1064 (SQL injection through marking blog
comments on bulk as spam in Gi
CVE-2022-1063 (The Thank Me Later WordPress plugin through 3.3.4 does not
sanitise an ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1062 (The th23 Social WordPress plugin through 1.2.0 does not
sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1061 (Heap Buffer Overflow in parseDragons in GitHub repository
radareorg/ra ...)
- radare2 <unfixed>
NOTE: https://huntr.dev/bounties/a7546dae-01c5-4fb0-8a8e-c04ea4e9bac7
@@ -9283,7 +9283,7 @@ CVE-2022-1052 (Heap Buffer Overflow in
iterate_chained_fixups in GitHub reposito
NOTE: https://huntr.dev/bounties/3b3b7f77-ab8d-4de3-999b-eeec0a3eebe7
NOTE:
https://github.com/radareorg/radare2/commit/0052500c1ed5bf8263b26b9fd7773dbdc6f170c4
CVE-2022-1051 (The WPQA Builder Plugin WordPress plugin before 5.2, used as a
compani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1050 (A flaw was found in the QEMU implementation of VMWare's
paravirtual RD ...)
- qemu <unfixed>
[bullseye] - qemu <no-dsa> (Minor issue)
@@ -12304,7 +12304,7 @@ CVE-2022-0875
CVE-2022-0874 (The WP Social Buttons WordPress plugin through 2.1 does not
sanitise a ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0873 (The Gmedia Photo Gallery WordPress plugin before 1.20.0 does
not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-26532
RESERVED
CVE-2022-26531
@@ -12448,7 +12448,7 @@ CVE-2022-26478
CVE-2022-26477
RESERVED
CVE-2022-0867 (The Pricing Table WordPress plugin before 3.6.1 fails to
properly sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-0866 (This is a concurrency issue that can result in the wrong caller
princi ...)
- wildfly <itp> (bug #752018)
CVE-2022-0865 (Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers
to cau ...)
@@ -84985,7 +84985,7 @@ CVE-2021-25121
CVE-2021-25120 (The Easy Social Feed Free and Pro WordPress plugins before
6.2.7 do no ...)
NOT-FOR-US: WordPress plugin
CVE-2021-25119 (The AGIL WordPress plugin through 1.0 accepts all zip files
and automa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2021-25118 (The Yoast SEO WordPress plugin before 17.3 discloses the full
internal ...)
NOT-FOR-US: WordPress plugin
CVE-2021-25117
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7de836b296cefc12302fd2fac2f558a2f4893b4f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7de836b296cefc12302fd2fac2f558a2f4893b4f
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
