Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b54910e6 by Moritz Muehlenhoff at 2022-07-19T17:17:59+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1025,7 +1025,7 @@ CVE-2022-35863
CVE-2022-35862
RESERVED
CVE-2022-35861 (pyenv 1.2.24 through 2.3.2 allows local users to gain
privileges via a ...)
- TODO: check
+ NOT-FOR-US: pyenv
CVE-2022-35860
RESERVED
CVE-2022-35859
@@ -3211,7 +3211,7 @@ CVE-2022-34915
CVE-2022-34914 (Webswing before 22.1.3 allows X-Forwarded-For header
injection. The cl ...)
NOT-FOR-US: Webswing
CVE-2022-34913 (** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow
via a Mar ...)
- TODO: check
+ NOT-FOR-US: md2roff
CVE-2022-34912 (An issue was discovered in MediaWiki before 1.37.3 and 1.38.x
before 1 ...)
- mediawiki 1:1.35.7-1
[bullseye] - mediawiki <postponed> (Minor issue, fix along with next
security release)
@@ -5644,17 +5644,17 @@ CVE-2022-34034
CVE-2022-34033 (HTMLDoc v1.9.15 was discovered to contain a heap overflow via
(write_h ...)
TODO: check
CVE-2022-34032 (Nginx NJS v0.7.5 was discovered to contain a segmentation
violation in ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34031 (Nginx NJS v0.7.5 was discovered to contain a segmentation
violation vi ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34030 (Nginx NJS v0.7.5 was discovered to contain a segmentation
violation vi ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34029 (Nginx NJS v0.7.4 was discovered to contain an out-of-bounds
read via n ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34028 (Nginx NJS v0.7.5 was discovered to contain a segmentation
violation vi ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34027 (Nginx NJS v0.7.4 was discovered to contain a segmentation
violation vi ...)
- TODO: check
+ NOT-FOR-US: njs
CVE-2022-34026
RESERVED
CVE-2022-34025
@@ -9849,7 +9849,7 @@ CVE-2022-32292
CVE-2022-32291 (In Real Player through 20.1.0.312, attackers can execute
arbitrary cod ...)
NOT-FOR-US: Real Player
CVE-2022-32290 (The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has
Incorre ...)
- TODO: check
+ NOT-FOR-US: Northern.tech Mender
CVE-2017-20040 (A vulnerability was found in SICUNET Access Controller
0.32-05z. It ha ...)
NOT-FOR-US: SICUNET Access Controller
CVE-2017-20039 (A vulnerability was found in SICUNET Access Controller
0.32-05z. It ha ...)
@@ -10044,7 +10044,7 @@ CVE-2022-32265 (qDecoder before 12.1.0 does not ensure
that the percent characte
CVE-2022-32264
RESERVED
CVE-2022-32263 (Pexip Infinity before 28.1 allows remote attackers to trigger
a softwa ...)
- TODO: check
+ NOT-FOR-US: Pexip Infinity
CVE-2022-32262 (A vulnerability has been identified in SINEMA Remote Connect
Server (A ...)
NOT-FOR-US: Siemens
CVE-2022-32261 (A vulnerability has been identified in SINEMA Remote Connect
Server (A ...)
@@ -10150,7 +10150,7 @@ CVE-2022-32227
CVE-2022-32226
RESERVED
CVE-2022-32225 (A reflected DOM-Based XSS vulnerability has been discovered in
the Hel ...)
- TODO: check
+ NOT-FOR-US: Veeam
CVE-2022-32224
RESERVED
CVE-2022-32223 (Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking
under ce ...)
@@ -10535,7 +10535,7 @@ CVE-2022-32116
CVE-2022-32115 (An issue in the isSVG() function of Known v1.2.2+2020061101
allows att ...)
NOT-FOR-US: Known
CVE-2022-32114 (An unrestricted file upload vulnerability in the Add New
Assets functi ...)
- TODO: check
+ NOT-FOR-US: Strapi
CVE-2022-32113
RESERVED
CVE-2022-32112
@@ -10651,7 +10651,7 @@ CVE-2022-32076
CVE-2022-32075
RESERVED
CVE-2022-32074 (A stored cross-site scripting (XSS) vulnerability in the
component aud ...)
- TODO: check
+ NOT-FOR-US: osTicket-plugins
CVE-2022-32073 (WolfSSH v1.4.7 was discovered to contain an integer overflow
via the f ...)
- wolfssh <itp> (bug #983449)
CVE-2022-32072
@@ -10669,7 +10669,7 @@ CVE-2022-32067
CVE-2022-32066
RESERVED
CVE-2022-32065 (An arbitrary file upload vulnerability in the background
management mo ...)
- TODO: check
+ NOT-FOR-US: RuoYi
CVE-2022-32064
RESERVED
CVE-2022-32063
@@ -11297,7 +11297,7 @@ CVE-2022-31795 (An issue was discovered on Fujitsu
ETERNUS CentricStor CS8000 (C
CVE-2022-31794 (An issue was discovered on Fujitsu ETERNUS CentricStor CS8000
(Control ...)
NOT-FOR-US: Fujitsu
CVE-2022-1933 (The CDI WordPress plugin before 5.1.9 does not sanitise and
escape a p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1932
RESERVED
CVE-2022-31799 (Bottle before 0.12.20 mishandles errors during early request
binding. ...)
@@ -11414,7 +11414,7 @@ CVE-2022-1914 (The Clean-Contact WordPress plugin
through 1.6 does not have CSRF
CVE-2022-1913 (The Add Post URL WordPress plugin through 2.1.0 does not have
CSRF che ...)
NOT-FOR-US: WordPress plugin
CVE-2022-1912 (The Button Widget Smartsoft plugin for WordPress is vulnerable
to Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-1911
RESERVED
CVE-2022-1910 (The Shortcodes and extra features for Phlox WordPress plugin
before 2. ...)
@@ -12206,17 +12206,17 @@ CVE-2022-31590 (SAP PowerDesigner Proxy - version
16.7, allows an attacker with
CVE-2022-31589 (Due to improper authorization check, business users who are
using Isra ...)
NOT-FOR-US: SAP
CVE-2022-31588 (The zippies/testplatform repository through 2016-07-19 on
GitHub allow ...)
- TODO: check
+ NOT-FOR-US: zippies/testplatform
CVE-2022-31587 (The yuriyouzhou/KG-fashion-chatbot repository through
2018-05-22 on Gi ...)
- TODO: check
+ NOT-FOR-US: yuriyouzhou/KG-fashion-chatbot
CVE-2022-31586 (The unizar-30226-2019-06/ChangePop-Back repository through
2019-06-04 ...)
- TODO: check
+ NOT-FOR-US: unizar-30226-2019-06/ChangePop-Back
CVE-2022-31585 (The umeshpatil-dev/Home__internet repository through
2020-08-28 on Git ...)
- TODO: check
+ NOT-FOR-US: umeshpatil-dev/Home__internet
CVE-2022-31584 (The stonethree/s3label repository through 2019-08-14 on GitHub
allows ...)
- TODO: check
+ NOT-FOR-US: stonethree/s3label
CVE-2022-31583 (The sravaniboinepelli/AutomatedQuizEval repository through
2020-04-27 ...)
- TODO: check
+ NOT-FOR-US: sravaniboinepelli/AutomatedQuizEval
CVE-2022-31582 (The shaolo1/VideoServer repository through 2019-09-21 on
GitHub allows ...)
TODO: check
CVE-2022-31581 (The scorelab/OpenMF repository before 2022-05-03 on GitHub
allows abso ...)
@@ -12939,7 +12939,7 @@ CVE-2022-1809 (Access of Uninitialized Pointer in
GitHub repository radareorg/ra
NOTE: https://huntr.dev/bounties/0730a95e-c485-4ff2-9a5d-bb3abfda0b17
NOTE:
https://github.com/radareorg/radare2/commit/919e3ac1a13f753c73e7a8e8d8bb4a143218732d
CVE-2022-31260 (In Montala ResourceSpace through 9.8 before r19636,
csv_export_results ...)
- TODO: check
+ NOT-FOR-US: Montala ResourceSpace
CVE-2022-31259 (The route lookup process in beego through 1.12.4 and 2.x
through 2.0.2 ...)
NOT-FOR-US: Beego
CVE-2022-31258 (In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x
before 2.1. ...)
@@ -12947,7 +12947,7 @@ CVE-2022-31258 (In Checkmk before 1.6.0p29, 2.x before
2.0.0p25, and 2.1.x befor
CVE-2022-1808 (Execution with Unnecessary Privileges in GitHub repository
polonel/tru ...)
NOT-FOR-US: Trudesk
CVE-2022-31257 (A vulnerability has been identified in Mendix Applications
using Mendi ...)
- TODO: check
+ NOT-FOR-US: Mendix
CVE-2022-31256
RESERVED
CVE-2022-31255
@@ -13074,20 +13074,19 @@ CVE-2022-31213 (An issue was discovered in
dbus-broker before 31. Multiple NULL
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2094722
NOTE: "CHANGES WITH 30:" mention: Fix NULL-derefs in the XML
configuration parser. Empty XML tags could
NOTE: have caused NULL-derefs before.
- TODO: Isolate upstream commit.
CVE-2022-31212 (An issue was discovered in dbus-broker before 31. It depends
on c-uitl ...)
- dbus-broker 30-1 (bug #1013343)
[bullseye] - dbus-broker 26-1+deb11u1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2094718
NOTE: Fixed by:
https://github.com/c-util/c-shquote/commit/7fd15f8e272136955f7ffc37df29fbca9ddceca1
(v1.0.0)
CVE-2022-31211 (An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is
a blank ...)
- TODO: check
+ NOT-FOR-US: Infiray
CVE-2022-31210 (An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The
binary file ...)
- TODO: check
+ NOT-FOR-US: Infiray
CVE-2022-31209 (An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The
firmware con ...)
- TODO: check
+ NOT-FOR-US: Infiray
CVE-2022-31208 (An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The
webserver co ...)
- TODO: check
+ NOT-FOR-US: Infiray
CVE-2022-31207
RESERVED
CVE-2022-31206
@@ -13099,9 +13098,9 @@ CVE-2022-31204
CVE-2022-31203
RESERVED
CVE-2022-31202 (The export function in SoftGuard Web (SGW) before 5.1.5 allows
directo ...)
- TODO: check
+ NOT-FOR-US: SoftGuard Web
CVE-2022-31201 (SoftGuard Web (SGW) before 5.1.5 allows HTML injection. ...)
- TODO: check
+ NOT-FOR-US: SoftGuard Web
CVE-2022-31200
RESERVED
CVE-2022-31199
@@ -13183,11 +13182,11 @@ CVE-2022-31163
CVE-2022-31162
RESERVED
CVE-2022-31161 (Roxy-WI is a Web interface for managing HAProxy, Nginx and
Keepalived ...)
- TODO: check
+ NOT-FOR-US: Roxy-WI
CVE-2022-31160
RESERVED
CVE-2022-31159 (The AWS SDK for Java enables Java developers to work with
Amazon Web S ...)
- TODO: check
+ NOT-FOR-US: AWS SDK for Java
CVE-2022-31158 (LTI 1.3 Tool Library is a library used for building
IMS-certified LTI ...)
TODO: check
CVE-2022-31157 (LTI 1.3 Tool Library is a library used for building
IMS-certified LTI ...)
@@ -13399,21 +13398,21 @@ CVE-2022-31081 (HTTP::Daemon is a simple http server
class written in perl. Vers
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0
NOTE: Testcase:
https://github.com/libwww-perl/HTTP-Daemon/commit/faebad54455c2c2919e234202362570925fb99d1
CVE-2022-31080 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31079 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31078 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31077 (KubeEdge is built upon Kubernetes and extends native
containerized app ...)
NOT-FOR-US: KubeEdge
CVE-2022-31076 (KubeEdge is built upon Kubernetes and extends native
containerized app ...)
NOT-FOR-US: KubeEdge
CVE-2022-31075 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31074 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31073 (KubeEdge is an open source system for extending native
containerized a ...)
- TODO: check
+ NOT-FOR-US: KubeEdge
CVE-2022-31072 (Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0
and 4.24 ...)
- ruby-octokit <not-affected> (No vulnerable version was uploaded to
the archive)
NOTE:
https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6
@@ -13526,7 +13525,7 @@ CVE-2022-31030 (containerd is an open source container
runtime. A bug was found
- containerd 1.6.6~ds1-1
NOTE:
https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf
CVE-2022-31029 (AdminLTE is a Pi-hole Dashboard for stats and configuration.
In affect ...)
- TODO: check
+ NOT-FOR-US: AdminLTE
CVE-2022-31028 (MinIO is a multi-cloud object storage solution. Starting with
version ...)
NOT-FOR-US: MinIO
CVE-2022-31027 (OAuthenticator is an OAuth token library for the JupyerHub
login handl ...)
@@ -13568,7 +13567,7 @@ CVE-2022-31014 (Nextcloud server is an open source
personal cloud server. Affect
CVE-2022-31013 (Chat Server is the chat server for Vartalap, an open-source
messaging ...)
NOT-FOR-US: chat server for Vartalap
CVE-2022-31012 (Git for Windows is a fork of Git that contains
Windows-specific patche ...)
- TODO: check
+ NOT-FOR-US: Git for Windows
CVE-2022-31011 (TiDB is an open-source NewSQL database that supports Hybrid
Transactio ...)
NOT-FOR-US: TiDB
CVE-2022-31010
@@ -13633,9 +13632,9 @@ CVE-2022-30984
CVE-2022-30983
RESERVED
CVE-2022-30982 (An issue was discovered in Gentics CMS before 5.43.1. There is
stored ...)
- TODO: check
+ NOT-FOR-US: Gentics CMS
CVE-2022-30981 (An issue was discovered in Gentics CMS before 5.43.1. By
uploading a m ...)
- TODO: check
+ NOT-FOR-US: Gentics CMS
CVE-2022-30980
RESERVED
CVE-2022-30979
@@ -13882,7 +13881,7 @@ CVE-2022-30940
CVE-2022-30939
RESERVED
CVE-2022-30938 (A vulnerability has been identified in EN100 Ethernet module
DNP3 IP v ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2022-30937 (A vulnerability has been identified in EN100 Ethernet module
DNP3 IP v ...)
NOT-FOR-US: Siemens
CVE-2022-30792 (In CmpChannelServer of CODESYS V3 in multiple versions an
uncontrolled ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b54910e6703b2420c0b04796b8c06a6ceb68862b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b54910e6703b2420c0b04796b8c06a6ceb68862b
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
