Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6bbdf8b0 by security tracker role at 2022-05-30T20:10:26+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,49 @@
+CVE-2022-31813
+ RESERVED
+CVE-2022-31812
+ RESERVED
+CVE-2022-31811
+ RESERVED
+CVE-2022-31810
+ RESERVED
+CVE-2022-31809
+ RESERVED
+CVE-2022-31808
+ RESERVED
+CVE-2022-31807
+ RESERVED
+CVE-2022-31806
+ RESERVED
+CVE-2022-31805
+ RESERVED
+CVE-2022-31804
+ RESERVED
+CVE-2022-31803
+ RESERVED
+CVE-2022-31802
+ RESERVED
+CVE-2022-31801
+ RESERVED
+CVE-2022-31800
+ RESERVED
+CVE-2022-1945
+ RESERVED
+CVE-2022-1944
+ RESERVED
+CVE-2022-1943
+ RESERVED
+CVE-2022-1942
+ RESERVED
+CVE-2022-1941
+ RESERVED
+CVE-2022-1940
+ RESERVED
+CVE-2022-1939
+ RESERVED
+CVE-2022-1938
+ RESERVED
+CVE-2022-1937
+ RESERVED
CVE-2022-XXXX [Sanitizing and other XSS protections]
- spip 4.1.2+dfsg-1
[bullseye] - spip 3.2.11-3+deb11u4
@@ -3549,14 +3595,14 @@ CVE-2022-30526
RESERVED
CVE-2022-30525 (A OS command injection vulnerability in the CGI program of
Zyxel USG F ...)
NOT-FOR-US: Zyxel
-CVE-2022-1646
- RESERVED
-CVE-2022-1645
- RESERVED
-CVE-2022-1644
- RESERVED
-CVE-2022-1643
- RESERVED
+CVE-2022-1646 (The Simple Real Estate Pack WordPress plugin through 1.4.8 does
not sa ...)
+ TODO: check
+CVE-2022-1645 (The Amazon Link WordPress plugin through 3.2.10 does not
sanitise and ...)
+ TODO: check
+CVE-2022-1644 (The Call&Book Mobile Bar WordPress plugin through 1.2.2
does not s ...)
+ TODO: check
+CVE-2022-1643 (The Birthdays Widget WordPress plugin through 1.7.18 does not
sanitise ...)
+ TODO: check
CVE-2022-30524 (There is an invalid memory access in the TextLine class in
TextOutputD ...)
- xpdf <not-affected> (Debian uses poppler, which is not affected)
CVE-2022-30523 (Trend Micro Password Manager (Consumer) version 5.0.0.1266 and
below i ...)
@@ -4166,8 +4212,8 @@ CVE-2022-1613
RESERVED
CVE-2022-1612
RESERVED
-CVE-2022-1611
- RESERVED
+CVE-2022-1611 (The Bulk Page Creator WordPress plugin before 1.1.4 does not
protect i ...)
+ TODO: check
CVE-2022-1610
RESERVED
CVE-2022-1609
@@ -4225,8 +4271,8 @@ CVE-2022-1591
RESERVED
CVE-2022-1590 (A vulnerability was found in Bludit 3.13.1. It has been
declared as pr ...)
NOT-FOR-US: Bludit
-CVE-2022-1589
- RESERVED
+CVE-2022-1589 (The Change wp-admin login WordPress plugin before 1.1.0 does
not prope ...)
+ TODO: check
CVE-2022-30292 (thread_call in sqbaselib.cpp in SQUIRREL 3.2 lacks a certain
sq_reserv ...)
- squirrel3 <unfixed>
[bullseye] - squirrel3 <no-dsa> (Minor issue)
@@ -4377,10 +4423,10 @@ CVE-2022-30228
RESERVED
CVE-2022-1584 (Reflected XSS in GitHub repository microweber/microweber prior
to 1.2. ...)
NOT-FOR-US: microweber
-CVE-2022-1583
- RESERVED
-CVE-2022-1582
- RESERVED
+CVE-2022-1583 (The External Links in New Window / New Tab WordPress plugin
before 1.4 ...)
+ TODO: check
+CVE-2022-1582 (The External Links in New Window / New Tab WordPress plugin
before 1.4 ...)
+ TODO: check
CVE-2022-1581
RESERVED
CVE-2022-1580
@@ -4407,8 +4453,8 @@ CVE-2022-1570
RESERVED
CVE-2022-1569
RESERVED
-CVE-2022-1568
- RESERVED
+CVE-2022-1568 (The Team Members WordPress plugin before 5.1.1 does not escape
some of ...)
+ TODO: check
CVE-2021-46810
RESERVED
CVE-2021-46809
@@ -4653,19 +4699,19 @@ CVE-2022-30127
RESERVED
CVE-2022-1567 (The WP-JS plugin for WordPress contains a script called
wp-js.php with ...)
NOT-FOR-US: WP-JS plugin for WordPress
-CVE-2022-1566
- RESERVED
+CVE-2022-1566 (The Quotes llama WordPress plugin through 0.7 does not sanitise
and es ...)
+ TODO: check
CVE-2022-1565
RESERVED
-CVE-2022-1564
- RESERVED
+CVE-2022-1564 (The Form Maker by 10Web WordPress plugin before 1.14.12 does
not sanit ...)
+ TODO: check
CVE-2022-1563
RESERVED
-CVE-2022-1562
- RESERVED
+CVE-2022-1562 (The Enable SVG WordPress plugin before 1.4.0 does not sanitise
uploade ...)
+ TODO: check
CVE-2022-1561
RESERVED
-CVE-2022-1560 (The Amministrazione Aperta WordPress plugin through 3.7.3 does
not val ...)
+CVE-2022-1560 (The Amministrazione Aperta WordPress plugin before 3.8 does not
valida ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1559 (The Clipr WordPress plugin through 1.2.3 does not sanitise and
escape ...)
NOT-FOR-US: WordPress plugin
@@ -4673,8 +4719,8 @@ CVE-2022-1558 (The Curtain WordPress plugin through 1.0.2
does not sanitise and
NOT-FOR-US: WordPress plugin
CVE-2022-1557 (The ULeak Security & Monitoring WordPress plugin through
1.2.3 doe ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-1556
- RESERVED
+CVE-2022-1556 (The StaffList WordPress plugin before 3.1.5 does not properly
sanitise ...)
+ TODO: check
CVE-2022-1555 (DOM XSS in microweber ver 1.2.15 in GitHub repository
microweber/micro ...)
NOT-FOR-US: microweber
CVE-2022-1554 (Path Traversal due to `send_file` call in GitHub repository
clinical-g ...)
@@ -5231,8 +5277,8 @@ CVE-2022-29490
RESERVED
CVE-2022-1543 (Improper handling of Length parameter in GitHub repository
erudika/sco ...)
NOT-FOR-US: scoold
-CVE-2022-1542
- RESERVED
+CVE-2022-1542 (The HPB Dashboard WordPress plugin through 1.3.1 does not
sanitise and ...)
+ TODO: check
CVE-2022-1541
RESERVED
CVE-2022-1540
@@ -5270,10 +5316,10 @@ CVE-2022-1529
- firefox-esr 91.9.1esr-1
- thunderbird <unfixed>
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/#CVE-2022-1529
-CVE-2022-1528
- RESERVED
-CVE-2022-1527
- RESERVED
+CVE-2022-1528 (The VikBooking Hotel Booking Engine & PMS WordPress plugin
before ...)
+ TODO: check
+CVE-2022-1527 (The WP 2FA WordPress plugin before 2.2.1 does not sanitise and
escape ...)
+ TODO: check
CVE-2021-4227
RESERVED
CVE-2022-29908
@@ -5813,8 +5859,8 @@ CVE-2022-1458 (Stored XSS Leads To Session Hijacking in
GitHub repository openem
NOT-FOR-US: OpenEMR
CVE-2022-1457 (Store XSS in title parameter executing at EditUser Page &
EditProd ...)
NOT-FOR-US: facturascripts
-CVE-2022-1456
- RESERVED
+CVE-2022-1456 (The Poll Maker WordPress plugin before 4.0.2 does not sanitise
and esc ...)
+ TODO: check
CVE-2021-46789 (Configuration defects in the secure OS module.Successful
exploitation ...)
NOT-FOR-US: Huawei
CVE-2021-46788 (Third-party pop-up window coverage vulnerability in the
iConnect modul ...)
@@ -6567,8 +6613,8 @@ CVE-2022-1397 (API Privilege Escalation in GitHub
repository alextselegidis/easy
NOT-FOR-US: alextselegidis/easyappointments
CVE-2022-1396 (The Donorbox WordPress plugin before 7.1.7 does not sanitise
and escap ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-1395
- RESERVED
+CVE-2022-1395 (The Easy FAQ with Expanding Text WordPress plugin through
3.2.8.3.1 do ...)
+ TODO: check
CVE-2022-1394
RESERVED
CVE-2022-1393 (The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle
field an ...)
@@ -6820,8 +6866,8 @@ CVE-2022-28717 (Cross-site scripting vulnerability in
Rebooter(WATCH BOOT nino R
NOT-FOR-US: Rebooter
CVE-2022-27632 (Cross-site request forgery (CSRF) vulnerability in
Rebooter(WATCH BOOT ...)
NOT-FOR-US: Rebooter
-CVE-2022-1387
- RESERVED
+CVE-2022-1387 (The No Future Posts WordPress plugin through 1.4 does not
escape its s ...)
+ TODO: check
CVE-2022-1386 (The Fusion Builder WordPress plugin before 3.6.2, used in the
Avada th ...)
NOT-FOR-US: WordPress plugin
CVE-2022-29405 (In Apache Archiva, any registered user can reset password for
any user ...)
@@ -7935,8 +7981,8 @@ CVE-2022-1301
RESERVED
CVE-2022-1300 (Multiple Version of TRUMPF TruTops products expose a service
function ...)
NOT-FOR-US: TRUMPF TruTops
-CVE-2022-1299
- RESERVED
+CVE-2022-1299 (The Slideshow WordPress plugin through 2.3.1 does not sanitize
and esc ...)
+ TODO: check
CVE-2022-1298 (The Tabs WordPress plugin before 2.2.8 does not sanitise and
escape Ta ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1297 (Out-of-bounds Read in r_bin_ne_get_entrypoints function in
GitHub repo ...)
@@ -7949,8 +7995,8 @@ CVE-2022-1296 (Out-of-bounds read in
`r_bin_ne_get_relocs` function in GitHub re
NOTE:
https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6
CVE-2022-1295 (Prototype Pollution in GitHub repository
alvarotrigo/fullpage.js prior ...)
NOT-FOR-US: fullpage.js
-CVE-2022-1294
- RESERVED
+CVE-2022-1294 (The IMDB info box WordPress plugin through 2.0 does not
sanitize and e ...)
+ TODO: check
CVE-2022-1293
RESERVED
CVE-2022-1292 (The c_rehash script does not properly sanitise shell
metacharacters to ...)
@@ -8477,8 +8523,8 @@ CVE-2022-28801
RESERVED
CVE-2022-28800
RESERVED
-CVE-2022-28799
- RESERVED
+CVE-2022-28799 (The TikTok application before 23.8.4 for Android allows
account takeov ...)
+ TODO: check
CVE-2022-28798
RESERVED
CVE-2022-28797
@@ -8791,8 +8837,8 @@ CVE-2022-1276 (Out-of-bounds Read in mrb_get_args in
GitHub repository mruby/mru
- mruby <not-affected> (Vulnerable code introduced later)
NOTE: https://huntr.dev/bounties/6ea041d1-e2aa-472c-bf3e-da5fa8726c25
NOTE:
https://github.com/mruby/mruby/commit/c8c083cb750606b2da81582cd8e43b442bb143e6
-CVE-2022-1275
- RESERVED
+CVE-2022-1275 (The BannerMan WordPress plugin through 0.2.4 does not sanitize
or esca ...)
+ TODO: check
CVE-2022-1274
RESERVED
CVE-2022-1273 (The Import WP WordPress plugin before 2.4.6 does not validate
the impo ...)
@@ -9739,8 +9785,8 @@ CVE-2022-1204
{DSA-5127-1}
- linux 5.17.3-1
NOTE: https://www.openwall.com/lists/oss-security/2022/04/02/2
-CVE-2022-1203
- RESERVED
+CVE-2022-1203 (The Content Mask WordPress plugin before 1.8.4.1 does not have
authori ...)
+ TODO: check
CVE-2022-1202
RESERVED
CVE-2022-1201 (NULL Pointer Dereference in mrb_vm_exec with super in GitHub
repositor ...)
@@ -13059,8 +13105,8 @@ CVE-2022-1011 (A use-after-free flaw was found in the
Linux kernel’s FUSE
NOTE:
https://git.kernel.org/linus/0c4bcfdecb1ac0967619ee7ff44871d93c08c909 (5.17-rc8)
CVE-2022-1010
RESERVED
-CVE-2022-1009
- RESERVED
+CVE-2022-1009 (The Smush WordPress plugin before 3.9.9 does not sanitise and
escape a ...)
+ TODO: check
CVE-2022-1008 (The One Click Demo Import WordPress plugin before 3.1.0 does
not valid ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1007 (The Advanced Booking Calendar WordPress plugin before 1.7.1
does not s ...)
@@ -18602,8 +18648,8 @@ CVE-2022-0644 [vfs: check fd has read access in
kernel_read_file_from_fd()]
NOTE:
https://git.kernel.org/linus/032146cda85566abcd1c4884d9d23e4e30a07e9a (5.15-rc7)
CVE-2022-0643 (The Bank Mellat WordPress plugin through 1.3.7 does not
sanitize and e ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-0642
- RESERVED
+CVE-2022-0642 (The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not
proper ...)
+ TODO: check
CVE-2022-0641 (The Popup Like box WordPress plugin before 3.6.1 does not
sanitize and ...)
NOT-FOR-US: WordPress plugin
CVE-2022-0640 (The Pricing Table Builder WordPress plugin before 1.1.5 does
not sanit ...)
@@ -22862,8 +22908,8 @@ CVE-2022-0378 (Cross-site Scripting (XSS) - Reflected
in Packagist microweber/mi
NOT-FOR-US: microweber
CVE-2022-0377 (Users of the LearnPress WordPress plugin before 4.1.5 can
upload an im ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-0376
- RESERVED
+CVE-2022-0376 (The User Meta WordPress plugin before 2.4.3 does not sanitise
and esca ...)
+ TODO: check
CVE-2022-0375 (Cross-site Scripting (XSS) - Stored in Packagist
remdex/livehelperchat ...)
NOT-FOR-US: livehelperchat
CVE-2022-0374 (Cross-site Scripting (XSS) - Stored in Packagist
remdex/livehelperchat ...)
@@ -33888,6 +33934,7 @@ CVE-2021-23170
CVE-2021-23148
RESERVED
CVE-2021-44759 (Improper Authentication vulnerability in TLS origin validation
of Apac ...)
+ {DSA-5153-1}
- trafficserver 9.1.0+ds-1
NOTE: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
NOTE: Mark first 9.x version as fixed version, as the issue only
affects versions
@@ -36228,6 +36275,7 @@ CVE-2021-3983 (kimai2 is vulnerable to Improper
Neutralization of Input During W
CVE-2022-21742
RESERVED
CVE-2021-44040 (Improper Input Validation vulnerability in request line
parsing of Apa ...)
+ {DSA-5153-1}
- trafficserver 9.1.2+ds-1
NOTE: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
NOTE:
https://github.com/apache/trafficserver/commit/85c319a7f7c0537bee408ea25df6f1a5ed0a4071
@@ -41581,11 +41629,11 @@ CVE-2021-42862
RESERVED
CVE-2021-42861
RESERVED
-CVE-2021-42860 (A stack buffer overflow exists in Mini-XML v3.2. When
inputting an unf ...)
+CVE-2021-42860 (** DISPUTED ** A stack buffer overflow exists in Mini-XML
v3.2. When i ...)
- mxml <undetermined>
NOTE: https://github.com/michaelrsweet/mxml/issues/286
TODO: check, unclear details from reporter and upstream cannot
reproduce on current master
-CVE-2021-42859 (A memory leak issue was discovered in Mini-XML v3.2 that could
cause a ...)
+CVE-2021-42859 (** DISPUTED ** A memory leak issue was discovered in Mini-XML
v3.2 tha ...)
- mxml <undetermined>
NOTE: https://github.com/michaelrsweet/mxml/issues/286
TODO: check, unclear details from reporter and upstream cannot
reproduce on current master
@@ -54677,6 +54725,7 @@ CVE-2021-38163 (SAP NetWeaver (Visual Composer 7.0 RT)
versions - 7.30, 7.31, 7.
CVE-2021-38162 (SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81,
KRNL64NUC - 7.22 ...)
NOT-FOR-US: SAP
CVE-2021-38161 (Improper Authentication vulnerability in TLS origin
verification of Ap ...)
+ {DSA-5153-1}
- trafficserver 9.1.0+ds-1
NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
NOTE: Mark first 9.x version as the fixed version as workaround, the
issue does
@@ -57267,18 +57316,21 @@ CVE-2021-37159 (hso_free_net_device in
drivers/net/usb/hso.c in the Linux kernel
CVE-2021-37150
RESERVED
CVE-2021-37149 (Improper Input Validation vulnerability in header parsing of
Apache Tr ...)
+ {DSA-5153-1}
- trafficserver 9.1.1+ds-1
NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
NOTE: https://github.com/apache/trafficserver/pull/8458/
NOTE:
https://github.com/apache/trafficserver/commit/2addc8ca71449ceac0d5b80172460ee09c938f5e
(8.1.x)
NOTE:
https://github.com/apache/trafficserver/commit/83c89f3d217d473ecb000b68c910c0f183c3a355
(master)
CVE-2021-37148 (Improper input validation vulnerability in header parsing of
Apache Tr ...)
+ {DSA-5153-1}
- trafficserver 9.1.1+ds-1
NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
NOTE: https://github.com/apache/trafficserver/pull/8457/
NOTE:
https://github.com/apache/trafficserver/commit/6e5070118a20772a30c3fccee2cf1c44f0a21fc0
(master)
NOTE:
https://github.com/apache/trafficserver/commit/e2c9ac217f24dc3e91ff2c9f52b52093e8fb32d5
(8.1.x)
CVE-2021-37147 (Improper input validation vulnerability in header parsing of
Apache Tr ...)
+ {DSA-5153-1}
- trafficserver 9.1.1+ds-1
NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
NOTE:
https://github.com/apache/trafficserver/commit/64f25678bfbbd1433cce703e3c43bcc49a53de56
(master)
@@ -118318,6 +118370,7 @@ CVE-2020-25614 (xmlquery before 1.3.1 lacks a check
for whether a LoadURL respon
- golang-github-antchfx-xmlquery 1.3.3-1
NOTE: https://github.com/antchfx/xmlquery/issues/39
CVE-2014-10402 (An issue was discovered in the DBI module through 1.643 for
Perl. DBD: ...)
+ {DLA-3035-1}
- libdbi-perl 1.643-3 (bug #972180)
[buster] - libdbi-perl 1.642-1+deb10u2
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=99508#txn-1911590
@@ -184875,6 +184928,7 @@ CVE-2019-18279 (In Phoenix SCT WinFlash 1.1.12.0
through 1.5.74.0, the included
CVE-2019-18278 (When executing VideoLAN VLC media player 3.0.8 with libqt on
Windows, ...)
NOT-FOR-US: VLC on Windows
CVE-2019-18277 (A flaw was found in HAProxy before 2.0.6. In legacy mode,
messages fea ...)
+ {DLA-3034-1}
- haproxy 2.0.6-1
[buster] - haproxy 1.8.19-1+deb10u3
[jessie] - haproxy <no-dsa> (Minor issue)
@@ -233242,10 +233296,12 @@ CVE-2018-20105 (A Inclusion of Sensitive
Information in Log Files vulnerability
CVE-2018-20104
RESERVED
CVE-2018-20103 (An issue was discovered in dns.c in HAProxy through 1.8.14. In
the cas ...)
+ {DLA-3034-1}
- haproxy 1.8.15-1 (bug #916307)
[jessie] - haproxy <not-affected> (Vulnerable code not present)
NOTE:
http://git.haproxy.org/?p=haproxy.git;a=commit;h=58df5aea0a0c926b2238f65908f5e9f83d1cca25
CVE-2018-20102 (An out-of-bounds read in dns_validate_dns_response in dns.c
was discov ...)
+ {DLA-3034-1}
- haproxy 1.8.15-1 (bug #916308)
[jessie] - haproxy <not-affected> (Vulnerable code not present)
NOTE:
http://git.haproxy.org/?p=haproxy.git;a=commit;h=efbbdf72992cd20458259962346044cafd9331c0
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6bbdf8b0331010bf2178c7a9951b855998d912a3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6bbdf8b0331010bf2178c7a9951b855998d912a3
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
