Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3f518319 by Salvatore Bonaccorso at 2022-06-03T21:00:07+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -17,7 +17,7 @@ CVE-2022-32267
CVE-2022-32266
RESERVED
CVE-2022-32265 (qDecoder before 12.1.0 does not ensure that the percent
character is f ...)
- TODO: check
+ NOT-FOR-US: qDecoder
CVE-2022-32264
RESERVED
CVE-2022-32263
@@ -3282,7 +3282,7 @@ CVE-2022-31020
CVE-2022-31019
RESERVED
CVE-2022-31018 (Play Framework is a web framework for Java and Scala. A denial
of serv ...)
- TODO: check
+ NOT-FOR-US: Play Framework
CVE-2022-31017
RESERVED
CVE-2022-31016
@@ -4997,7 +4997,7 @@ CVE-2022-30466
CVE-2022-30465
RESERVED
CVE-2022-30464 (ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to
Cross Sit ...)
- TODO: check
+ NOT-FOR-US: ChatBot App with Suggestion in PHP/OOP
CVE-2022-30463 (Automotive Shop Management System v1.0 is vulnerable to SQL
Injection ...)
NOT-FOR-US: Automotive Shop Management System
CVE-2022-30462 (Water-billing-management-system v1.0 is affected by: Cross
Site Script ...)
@@ -5007,7 +5007,7 @@ CVE-2022-30461 (Water-billing-management-system v1.0 is
vulnerable to SQL Inject
CVE-2022-30460 (Simple Social Networking Site v1.0 is vulnerable to Cross Site
Scripti ...)
NOT-FOR-US: Simple Social Networking Site
CVE-2022-30459 (ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to
SQL Injec ...)
- TODO: check
+ NOT-FOR-US: ChatBot App with Suggestion in PHP/OOP
CVE-2022-30458 (Automotive Shop Management System v1.0 is vulnerable to Cross
Site Scr ...)
NOT-FOR-US: Automotive Shop Management System
CVE-2022-30457
@@ -5601,19 +5601,19 @@ CVE-2022-30240 (An argument injection vulnerability in
the browser-based authent
CVE-2022-30239 (An argument injection vulnerability in the browser-based
authenticatio ...)
NOT-FOR-US: Magnitude Simba Amazon Athena JDBC Driver
CVE-2022-30238 (A CWE-287: Improper Authentication vulnerability exists that
could all ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30237 (A CWE-311: Missing Encryption of Sensitive Data vulnerability
exists t ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30236 (A CWE-669: Incorrect Resource Transfer Between Spheres
vulnerability e ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30235 (A CWE-307: Improper Restriction of Excessive Authentication
Attempts v ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30234 (A CWE-798: Use of Hard-coded Credentials vulnerability exists
that cou ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30233 (A CWE-20: Improper Input Validation vulnerability exists that
could al ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30232 (A CWE-20: Improper Input Validation vulnerability exists that
could ca ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2022-30231
RESERVED
CVE-2022-30230
@@ -7123,7 +7123,7 @@ CVE-2022-29769
CVE-2022-29768
RESERVED
CVE-2022-29767 (adbyby v2.7 allows external users to make connections via port
8118. T ...)
- TODO: check
+ NOT-FOR-US: adbyby
CVE-2022-29766
RESERVED
CVE-2022-29765
@@ -7383,7 +7383,7 @@ CVE-2022-29639 (TOTOLINK A3100R V4.1.2cu.5050_B20200504
and V4.1.2cu.5247_B20211
CVE-2022-29638 (TOTOLINK A3100R V4.1.2cu.5050_B20200504 and
V4.1.2cu.5247_B20211129 we ...)
NOT-FOR-US: TOTOLINK
CVE-2022-29637 (An arbitrary file upload vulnerability in Mindoc v2.1-beta.5
allows at ...)
- TODO: check
+ NOT-FOR-US: Mindoc
CVE-2022-29636
RESERVED
CVE-2022-29635
@@ -7515,7 +7515,7 @@ CVE-2022-29596 (MicroStrategy Enterprise Manager 2022
allows authentication bypa
CVE-2022-29595
RESERVED
CVE-2022-29594 (eG Agent before 7.2 has weak file permissions that enable
escalation o ...)
- TODO: check
+ NOT-FOR-US: eG Agent
CVE-2022-29593
RESERVED
CVE-2022-1441 (MP4Box is a component of GPAC-2.0.0, which is a widely-used
third-part ...)
@@ -7698,7 +7698,7 @@ CVE-2022-29542
CVE-2022-29541
RESERVED
CVE-2022-29540 (resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple
XSS issu ...)
- TODO: check
+ NOT-FOR-US: RESI Gemini-Net
CVE-2022-29539 (resi-calltrace in RESI Gemini-Net 4.2 is affected by OS
Command Inject ...)
NOT-FOR-US: RESI Gemini-Net
CVE-2022-29538 (RESI Gemini-Net Web 4.2 is affected by Improper Access Control
in auth ...)
@@ -8082,7 +8082,7 @@ CVE-2022-1387 (The No Future Posts WordPress plugin
through 1.4 does not escape
CVE-2022-1386 (The Fusion Builder WordPress plugin before 3.6.2, used in the
Avada th ...)
NOT-FOR-US: WordPress plugin
CVE-2022-29405 (In Apache Archiva, any registered user can reset password for
any user ...)
- TODO: check
+ NOT-FOR-US: Apache Archiva
CVE-2022-1385 (Mattermost 6.4.x and earlier fails to properly invalidate
pending emai ...)
- mattermost-server <itp> (bug #823556)
CVE-2022-1384 (Mattermost version 6.4.x and earlier fails to properly check
the plugi ...)
@@ -8950,9 +8950,9 @@ CVE-2022-29087
CVE-2022-29086
RESERVED
CVE-2022-29085 (Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to
5.2.0.0 ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-29084 (Dell Unity, Dell UnityVSA, and Dell Unity XT versions before
5.2.0.0.5 ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-29083
RESERVED
CVE-2022-29082 (Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x,
19.2.x, 19.2.0 ...)
@@ -15143,21 +15143,21 @@ CVE-2021-46709 (phpLiteAdmin through 1.9.8.2 allows
XSS via the index.php newRow
CVE-2022-26979
RESERVED
CVE-2022-26978 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26977 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26976 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26975 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26974 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26973 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26972 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26971 (Barco Control Room Management Suite web application, which is
part of ...)
- TODO: check
+ NOT-FOR-US: Barco Control Room Management Suite
CVE-2022-26970
RESERVED
CVE-2022-26969
@@ -15304,7 +15304,7 @@ CVE-2022-26907 (Azure SDK for .NET Information
Disclosure Vulnerability. ...)
CVE-2022-26906
RESERVED
CVE-2022-26905 (Microsoft Edge (Chromium-based) Spoofing Vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2022-26904 (Windows User Profile Service Elevation of Privilege
Vulnerability. ...)
NOT-FOR-US: Microsoft
CVE-2022-26903 (Windows Graphics Component Remote Code Execution
Vulnerability. ...)
@@ -15398,13 +15398,13 @@ CVE-2022-26871 (An arbitrary file upload
vulnerability in Trend Micro Apex Centr
CVE-2022-26870
RESERVED
CVE-2022-26869 (Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains
an open ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-26868 (Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are
vulnera ...)
- TODO: check
+ NOT-FOR-US: EMC PowerStore
CVE-2022-26867 (PowerStore SW v2.1.1.0 supports the option to export data to
either a ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-26866 (Dell PowerStore Versions before v2.1.1.0. contains a Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-26865 (Dell Support Assist OS Recovery versions before 5.5.2 contain
an Authe ...)
NOT-FOR-US: Dell SupportAssist
CVE-2022-26864
@@ -16352,7 +16352,7 @@ CVE-2022-26498 (An issue was discovered in Asterisk
through 19.x. When using STI
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-29872
NOTE: https://downloads.asterisk.org/pub/security/AST-2022-001.html
CVE-2022-26497 (BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor
could have ...)
- TODO: check
+ NOT-FOR-US: BigBlueButton
CVE-2022-26496 (In nbd-server in nbd before 3.24, there is a stack-based
buffer overfl ...)
{DSA-5100-1}
- nbd 1:3.24-1 (bug #1006915)
@@ -20147,7 +20147,7 @@ CVE-2022-25165 (An issue was discovered in Amazon AWS
VPN Client 2.0.0. A TOCTOU
CVE-2022-25164
RESERVED
CVE-2022-25163 (Improper Input Validation vulnerability in Mitsubishi Electric
MELSEC- ...)
- TODO: check
+ NOT-FOR-US: Mitsubishi
CVE-2022-25162 (Improper Input Validation vulnerability in Mitsubishi Electric
MELSEC ...)
NOT-FOR-US: Mitsubishi
CVE-2022-25161 (Improper Input Validation vulnerability in Mitsubishi Electric
MELSEC ...)
@@ -26886,9 +26886,9 @@ CVE-2022-23239
CVE-2022-23238
RESERVED
CVE-2022-23237 (E-Series SANtricity OS Controller Software 11.x versions
through 11.70 ...)
- TODO: check
+ NOT-FOR-US: E-Series SANtricity OS Controller Software
CVE-2022-23236 (E-Series SANtricity OS Controller Software versions 11.40
through 11.7 ...)
- TODO: check
+ NOT-FOR-US: E-Series SANtricity OS Controller Software
CVE-2022-23235
RESERVED
CVE-2022-23234 (SnapCenter versions prior to 4.5 are susceptible to a
vulnerability wh ...)
@@ -27767,7 +27767,7 @@ CVE-2022-22979
CVE-2022-22978 (In Spring Security versions 5.5.6 and 5.6.3 and older
unsupported vers ...)
TODO: check
CVE-2022-22977 (VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains
an XML Ex ...)
- TODO: check
+ NOT-FOR-US: VMware
CVE-2022-22976 (Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to
5.6.4, a ...)
TODO: check
CVE-2022-22975 (An issue was discovered in the Pinniped Supervisor with either
LADPIde ...)
@@ -29422,9 +29422,9 @@ CVE-2022-22559 (Dell PowerScale OneFS, version 9.3.0,
contains a use of a broken
CVE-2022-22558 (Dell PowerEdge Server BIOS contains an Improper SMM
communication buff ...)
NOT-FOR-US: Dell
CVE-2022-22557 (PowerStore contains Plain-Text Password Storage Vulnerability
in Power ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-22556 (Dell PowerStore contains an Uncontrolled Resource Consumption
Vulnerab ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2022-22555
RESERVED
CVE-2022-22554 (Dell EMC System Update, version 1.9.2 and prior, contain an
Unprotecte ...)
@@ -67002,7 +67002,7 @@ CVE-2021-33617 (Zoho ManageEngine Password Manager Pro
before 11.2 11200 allows
CVE-2021-33616 (RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
...)
NOT-FOR-US: RSA Archer
CVE-2021-33615 (RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a
File with ...)
- TODO: check
+ NOT-FOR-US: RSA Archer
CVE-2021-33620 (Squid before 4.15 and 5.x before 5.0.6 allows remote servers
to cause ...)
{DSA-4924-1 DLA-2685-1}
- squid 4.13-10
@@ -117966,9 +117966,9 @@ CVE-2020-26187
CVE-2020-26186 (Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI
BIOS Ru ...)
NOT-FOR-US: Dell Inspiron 5675 BIOS
CVE-2020-26185 (Dell BSAFE Micro Edition Suite, versions prior to 4.5.1,
contain a Buf ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2020-26184 (Dell BSAFE Micro Edition Suite, versions prior to 4.5.1,
contain an Im ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2020-26183 (Dell EMC NetWorker versions prior to 19.3.0.2 contain an
improper auth ...)
NOT-FOR-US: EMC
CVE-2020-26182 (Dell EMC NetWorker versions prior to 19.3.0.2 contain an
incorrect pri ...)
@@ -129893,7 +129893,7 @@ CVE-2020-20973
CVE-2020-20972
RESERVED
CVE-2020-20971 (Cross Site Request Forgery (CSRF) vulnerability in PbootCMS
v2.0.3 via ...)
- TODO: check
+ NOT-FOR-US: PbootCMS
CVE-2020-20970
RESERVED
CVE-2020-20969
@@ -205886,11 +205886,11 @@ CVE-2019-12353
CVE-2019-12352
RESERVED
CVE-2019-12351 (An issue was discovered in zzcms 2019. SQL Injection exists in
dl/dl_p ...)
- TODO: check
+ NOT-FOR-US: zzcms
CVE-2019-12350 (An issue was discovered in zzcms 2019. SQL Injection exists in
dl/dl_d ...)
- TODO: check
+ NOT-FOR-US: zzcms
CVE-2019-12349 (An issue was discovered in zzcms 2019. SQL Injection exists in
/admin/ ...)
- TODO: check
+ NOT-FOR-US: zzcms
CVE-2019-12348 (An issue was discovered in zzcms 2019. SQL Injection exists in
user/zt ...)
NOT-FOR-US: zzcms
CVE-2019-12347 (In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when
attackers ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f518319c80bffb0864ee3c51216ab6b64263d79
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f518319c80bffb0864ee3c51216ab6b64263d79
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
