Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
aeeae369 by security tracker role at 2022-09-09T20:10:22+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,31 @@
+CVE-2022-40318
+ RESERVED
+CVE-2022-40317 (OpenKM 6.3.11 allows stored XSS related to the
javascript: s ...)
+ TODO: check
+CVE-2022-40316
+ RESERVED
+CVE-2022-40315
+ RESERVED
+CVE-2022-40314
+ RESERVED
+CVE-2022-40313
+ RESERVED
+CVE-2022-40309
+ RESERVED
+CVE-2022-40308
+ RESERVED
+CVE-2022-40199
+ RESERVED
+CVE-2022-38975
+ RESERVED
+CVE-2022-37346
+ RESERVED
+CVE-2022-3172
+ RESERVED
+CVE-2022-3171
+ RESERVED
+CVE-2022-3170
+ RESERVED
CVE-2022-40307 (An issue was discovered in the Linux kernel through 5.19.8.
drivers/fi ...)
- linux <unfixed>
NOTE:
https://git.kernel.org/linus/9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95
@@ -143,8 +171,8 @@ CVE-2022-40239
RESERVED
CVE-2022-40238
RESERVED
-CVE-2022-3169
- RESERVED
+CVE-2022-3169 (A flaw was found in the Linux kernel. A denial of service flaw
may occ ...)
+ TODO: check
CVE-2022-3168
RESERVED
CVE-2019-25076 (The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x
through 2.1 ...)
@@ -187,8 +215,8 @@ CVE-2022-40195
RESERVED
CVE-2022-40194
RESERVED
-CVE-2022-40191
- RESERVED
+CVE-2022-40191 (Authenticated (subscriber+) Stored Cross-Site Scripting (XSS)
vulnerab ...)
+ TODO: check
CVE-2022-40189
RESERVED
CVE-2022-40132
@@ -203,8 +231,8 @@ CVE-2022-38470
RESERVED
CVE-2022-38460
RESERVED
-CVE-2022-38144
- RESERVED
+CVE-2022-38144 (Cross-Site Request Forgery (CSRF) vulnerability in gVectors
Team wpFor ...)
+ TODO: check
CVE-2022-38140
RESERVED
CVE-2022-38139
@@ -231,8 +259,8 @@ CVE-2022-36790
RESERVED
CVE-2022-36388
RESERVED
-CVE-2022-36356
- RESERVED
+CVE-2022-36356 (Authenticated (admin+) Stored Cross-Site Scripting (XSS)
vulnerability ...)
+ TODO: check
CVE-2022-36340
RESERVED
CVE-2022-36299
@@ -384,18 +412,18 @@ CVE-2022-40139
RESERVED
CVE-2022-40138
RESERVED
-CVE-2022-40133
- RESERVED
-CVE-2022-38457
- RESERVED
-CVE-2022-38096
- RESERVED
+CVE-2022-40133 (A use-after-free(UAF) vulnerability was found in function
'vmw_execbuf ...)
+ TODO: check
+CVE-2022-38457 (A use-after-free(UAF) vulnerability was found in function
'vmw_cmd_res ...)
+ TODO: check
+CVE-2022-38096 (A NULL pointer dereference vulnerability was found in vmwgfx
driver in ...)
+ TODO: check
CVE-2022-36402
RESERVED
-CVE-2022-36280
- RESERVED
-CVE-2022-3147
- RESERVED
+CVE-2022-36280 (An out-of-bounds(OOB) memory access vulnerability was found in
vmwgfx ...)
+ TODO: check
+CVE-2022-3147 (Mattermost version 7.0.x and earlier fails to sufficiently
limit the i ...)
+ TODO: check
CVE-2022-3146
RESERVED
CVE-2022-3145
@@ -999,14 +1027,14 @@ CVE-2022-39848
RESERVED
CVE-2022-39847
RESERVED
-CVE-2022-39846
- RESERVED
-CVE-2022-39845
- RESERVED
-CVE-2022-39844
- RESERVED
-CVE-2022-3133
- RESERVED
+CVE-2022-39846 (DLL hijacking vulnerability in Smart Switch PC prior to
version 4.3.22 ...)
+ TODO: check
+CVE-2022-39845 (Improper validation of integrity check vulnerability in
Samsung Kies p ...)
+ TODO: check
+CVE-2022-39844 (Improper validation of integrity check vulnerability in Smart
Switch P ...)
+ TODO: check
+CVE-2022-3133 (OS Command Injection in GitHub repository jgraph/drawio prior
to 20.3. ...)
+ TODO: check
CVE-2022-3132
RESERVED
CVE-2022-3131
@@ -1107,20 +1135,20 @@ CVE-2022-39812
RESERVED
CVE-2022-39811
RESERVED
-CVE-2022-39810
- RESERVED
-CVE-2022-39809
- RESERVED
-CVE-2022-38701
- RESERVED
-CVE-2022-38700
- RESERVED
-CVE-2022-38081
- RESERVED
-CVE-2022-38064
- RESERVED
-CVE-2022-36423
- RESERVED
+CVE-2022-39810 (An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A
Reflect ...)
+ TODO: check
+CVE-2022-39809 (An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A
Reflect ...)
+ TODO: check
+CVE-2022-38701 (OpenHarmony-v3.1.2 and prior versions have a heap overflow
vulnerabili ...)
+ TODO: check
+CVE-2022-38700 (OpenHarmony-v3.1.1 and prior versions have a permission bypass
vulnera ...)
+ TODO: check
+CVE-2022-38081 (OpenHarmony-v3.1.2 and prior versions have a permission bypass
vulnera ...)
+ TODO: check
+CVE-2022-38064 (OpenHarmony-v3.1.2 and prior versions have a permission bypass
vulnera ...)
+ TODO: check
+CVE-2022-36423 (OpenHarmony-v3.1.2 and prior versions have an incorrect
configuration ...)
+ TODO: check
CVE-2022-3120 (A vulnerability classified as critical was found in
SourceCodester Cli ...)
NOT-FOR-US: SourceCodester Clinics Patient Management System
CVE-2022-3119
@@ -2597,8 +2625,8 @@ CVE-2022-39121
RESERVED
CVE-2022-39120
RESERVED
-CVE-2022-39119
- RESERVED
+CVE-2022-39119 (In network service, there is a missing permission check. This
could le ...)
+ TODO: check
CVE-2022-39118
RESERVED
CVE-2022-39117
@@ -2690,8 +2718,8 @@ CVE-2022-3078 (An issue was discovered in the Linux
kernel through 5.16-rc6. The
[bullseye] - linux 5.10.113-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/e6a21a14106d9718aa4f8e115b1e474888eeba44 (5.18-rc1)
-CVE-2022-3077
- RESERVED
+CVE-2022-3077 (A buffer overflow vulnerability was found in the Linux kernel
Intel ...)
+ TODO: check
CVE-2022-3076
RESERVED
CVE-2022-3075
@@ -3837,8 +3865,7 @@ CVE-2022-2966
RESERVED
CVE-2022-2965 (Improper Restriction of Rendered UI Layers or Frames in GitHub
reposit ...)
NOT-FOR-US: NotrinosERP
-CVE-2022-2964
- RESERVED
+CVE-2022-2964 (A flaw was found in the Linux kernel’s driver for the
ASIX AX881 ...)
- linux 5.16.10-1
[bullseye] - linux 5.10.103-1
[buster] - linux 4.19.232-1
@@ -4063,8 +4090,8 @@ CVE-2022-38641
RESERVED
CVE-2022-38640
RESERVED
-CVE-2022-38639
- RESERVED
+CVE-2022-38639 (A cross-site scripting (XSS) vulnerability in Markdown-Nice
v1.8.22 al ...)
+ TODO: check
CVE-2022-38638
RESERVED
CVE-2022-38637
@@ -4111,12 +4138,12 @@ CVE-2022-38617
RESERVED
CVE-2022-38616
RESERVED
-CVE-2022-38615
- RESERVED
-CVE-2022-38614
- RESERVED
-CVE-2022-38613
- RESERVED
+CVE-2022-38615 (SmartVista SVFE2 v2.2.22 was discovered to contain multiple
SQL inject ...)
+ TODO: check
+CVE-2022-38614 (An issue in the IGB Files and OutfileService features of
SmartVista Ca ...)
+ TODO: check
+CVE-2022-38613 (A Path Traversal vulnerability in SmartVista Cardgen v3.28.0
allows au ...)
+ TODO: check
CVE-2022-38612
RESERVED
CVE-2022-38611
@@ -4525,8 +4552,7 @@ CVE-2022-2907
NOTE:
https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/
CVE-2022-2906
RESERVED
-CVE-2022-2905
- RESERVED
+CVE-2022-2905 (An out-of-bounds memory read flaw was found in the Linux
kernel's BPF ...)
- linux 5.19.6-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://www.openwall.com/lists/oss-security/2022/08/26/1
@@ -5174,36 +5200,36 @@ CVE-2022-38288
RESERVED
CVE-2022-38287
RESERVED
-CVE-2022-38286
- RESERVED
-CVE-2022-38285
- RESERVED
-CVE-2022-38284
- RESERVED
-CVE-2022-38283
- RESERVED
-CVE-2022-38282
- RESERVED
-CVE-2022-38281
- RESERVED
-CVE-2022-38280
- RESERVED
-CVE-2022-38279
- RESERVED
-CVE-2022-38278
- RESERVED
-CVE-2022-38277
- RESERVED
-CVE-2022-38276
- RESERVED
-CVE-2022-38275
- RESERVED
-CVE-2022-38274
- RESERVED
-CVE-2022-38273
- RESERVED
-CVE-2022-38272
- RESERVED
+CVE-2022-38286 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/system/role/list. ...)
+ TODO: check
+CVE-2022-38285 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/system/menu/list. ...)
+ TODO: check
+CVE-2022-38284 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/system/department ...)
+ TODO: check
+CVE-2022-38283 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/video/list. ...)
+ TODO: check
+CVE-2022-38282 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/videoalbum/ ...)
+ TODO: check
+CVE-2022-38281 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/site/list. ...)
+ TODO: check
+CVE-2022-38280 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/image/list. ...)
+ TODO: check
+CVE-2022-38279 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/imagealbum/ ...)
+ TODO: check
+CVE-2022-38278 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/friendlylin ...)
+ TODO: check
+CVE-2022-38277 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/folderrollp ...)
+ TODO: check
+CVE-2022-38276 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/foldernotic ...)
+ TODO: check
+CVE-2022-38275 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/contact/lis ...)
+ TODO: check
+CVE-2022-38274 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/comment/lis ...)
+ TODO: check
+CVE-2022-38273 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/article/lis ...)
+ TODO: check
+CVE-2022-38272 (JFinal CMS 5.1.0 is vulnerable to SQL Injection via
/admin/article/lis ...)
+ TODO: check
CVE-2022-38271
RESERVED
CVE-2022-38270
@@ -5717,36 +5743,36 @@ CVE-2022-38107
RESERVED
CVE-2022-38106
RESERVED
-CVE-2022-38093
- RESERVED
-CVE-2022-38070
- RESERVED
-CVE-2022-38068
- RESERVED
-CVE-2022-38067
- RESERVED
+CVE-2022-38093 (Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in
All in O ...)
+ TODO: check
+CVE-2022-38070 (Privilege Escalation (subscriber+) vulnerability in Pop-up
plugin < ...)
+ TODO: check
+CVE-2022-38068 (Authenticated (admin+) Stored Cross-Site Scripting (XSS)
vulnerability ...)
+ TODO: check
+CVE-2022-38067 (Unauthenticated Event Deletion vulnerability in Totalsoft
Event Calend ...)
+ TODO: check
CVE-2022-38062
RESERVED
CVE-2022-38061
RESERVED
-CVE-2022-38059
- RESERVED
-CVE-2022-38058
- RESERVED
+CVE-2022-38059 (Cross-Site Request Forgery (CSRF) vulnerability in Alexey
Trofimov's A ...)
+ TODO: check
+CVE-2022-38058 (Authenticated (subscriber+) Plugin Setting change
vulnerability in WP ...)
+ TODO: check
CVE-2022-38054 (In Apache Airflow versions 2.2.4 through 2.3.3, the `database`
webserv ...)
- airflow <itp> (bug #819700)
-CVE-2022-37412
- RESERVED
-CVE-2022-37411
- RESERVED
-CVE-2022-37407
- RESERVED
-CVE-2022-37405
- RESERVED
-CVE-2022-37404
- RESERVED
-CVE-2022-37403
- RESERVED
+CVE-2022-37412 (Authenticated (admin+) Reflected Cross-Site Scripting (XSS)
vulnerabil ...)
+ TODO: check
+CVE-2022-37411 (Cross-Site Request Forgery (CSRF) vulnerability in Vinoj
Cardoza's Cap ...)
+ TODO: check
+CVE-2022-37407 (Multiple Authenticated Stored Cross-Site Scripting (XSS)
vulnerabiliti ...)
+ TODO: check
+CVE-2022-37405 (Cross-Site Request Forgery (CSRF) vulnerability in Mickey
Kay's Better ...)
+ TODO: check
+CVE-2022-37404 (Authenticated (admin+) Stored Cross-Site Scripting (XSS)
vulnerability ...)
+ TODO: check
+CVE-2022-37403 (Authenticated (admin+) Stored Cross-Site Scripting (XSS)
vulnerability ...)
+ TODO: check
CVE-2022-37402
RESERVED
CVE-2022-37344 (Missing Access Control vulnerability in PHP Crafts
Accommodation Syste ...)
@@ -5755,8 +5781,8 @@ CVE-2022-37339
RESERVED
CVE-2022-37338
RESERVED
-CVE-2022-37335
- RESERVED
+CVE-2022-37335 (Authenticated (author+) Stored Cross-Site Scripting (XSS)
vulnerabilit ...)
+ TODO: check
CVE-2022-37330
RESERVED
CVE-2022-37328
@@ -5765,8 +5791,8 @@ CVE-2022-36798
RESERVED
CVE-2022-36796 (Cross-Site Request Forgery (CSRF) vulnerability leading to
Stored Cros ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-36793
- RESERVED
+CVE-2022-36793 (Unauthenticated Plugin Settings Change & Data Deletion
vulnerabili ...)
+ TODO: check
CVE-2022-36791
RESERVED
CVE-2022-36428
@@ -5775,8 +5801,8 @@ CVE-2022-36427 (Missing Access Control vulnerability in
About Rentals. Inc. Abou
NOT-FOR-US: WordPress plugin
CVE-2022-36425 (Broken Access Control vulnerability in Beaver Builder plugin
<= 2.5 ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-36422
- RESERVED
+CVE-2022-36422 (Rating increase/decrease via race condition in Lester 'GaMerZ'
Chan WP ...)
+ TODO: check
CVE-2022-36405 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS)
vulnera ...)
NOT-FOR-US: WordPress plugin
CVE-2022-36394 (Authenticated (author+) SQL Injection (SQLi) vulnerability in
Contest ...)
@@ -5787,8 +5813,8 @@ CVE-2022-36387 (Broken Access Control vulnerability in
Alessio Caiazza's About M
NOT-FOR-US: WordPress plugin
CVE-2022-36383
RESERVED
-CVE-2022-36376
- RESERVED
+CVE-2022-36376 (Server-Side Request Forgery (SSRF) vulnerability in Rank Math
SEO plug ...)
+ TODO: check
CVE-2022-36373 (Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in
Simon Wa ...)
NOT-FOR-US: WordPress plugin
CVE-2022-36365
@@ -5805,12 +5831,12 @@ CVE-2022-36345
RESERVED
CVE-2022-35726 (Broken Authentication vulnerability in yotuwp Video Gallery
plugin < ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-35725
- RESERVED
-CVE-2022-35277
- RESERVED
-CVE-2022-35275
- RESERVED
+CVE-2022-35725 (Authenticated (admin+) Stored Cross-Site Scripting (XSS)
vulnerability ...)
+ TODO: check
+CVE-2022-35277 (Cross-Site Request Forgery (CSRF) vulnerability in GetResponse
plugin ...)
+ TODO: check
+CVE-2022-35275 (Authenticated (shop manager+) Reflected Cross-Site Scripting
(XSS) vul ...)
+ TODO: check
CVE-2022-35242 (Unauthenticated plugin settings change vulnerability in 59sec
THE Lead ...)
NOT-FOR-US: WordPress plugin
CVE-2022-35235 (Authenticated (admin+) Arbitrary File Read vulnerability in
XplodedThe ...)
@@ -7770,8 +7796,8 @@ CVE-2022-2594 (The Advanced Custom Fields WordPress
plugin before 5.12.3, Advanc
NOT-FOR-US: WordPress plugin
CVE-2022-2593 (The Better Search Replace WordPress plugin before 1.4.1 does
not prope ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-37299
- RESERVED
+CVE-2022-37299 (An issue was discovered in Shirne CMS 1.2.0. There is a Path
Traversal ...)
+ TODO: check
CVE-2022-37298
RESERVED
CVE-2022-37297
@@ -8828,82 +8854,82 @@ CVE-2022-36879 (An issue was discovered in the Linux
kernel through 5.18.14. xfr
{DSA-5207-1}
- linux 5.18.16-1
NOTE:
https://git.kernel.org/linus/f85daf0e725358be78dfd208dea5fd665d8cb901
(v5.19-rc8)
-CVE-2022-36878
- RESERVED
-CVE-2022-36877
- RESERVED
-CVE-2022-36876
- RESERVED
-CVE-2022-36875
- RESERVED
-CVE-2022-36874
- RESERVED
-CVE-2022-36873
- RESERVED
-CVE-2022-36872
- RESERVED
-CVE-2022-36871
- RESERVED
-CVE-2022-36870
- RESERVED
-CVE-2022-36869
- RESERVED
+CVE-2022-36878 (Exposure of Sensitive Information in Find My Mobile prior to
version 7 ...)
+ TODO: check
+CVE-2022-36877 (Exposure of Sensitive Information in FaqSymptomCardViewModel
in Samsun ...)
+ TODO: check
+CVE-2022-36876 (Improper authorization in UPI payment in Samsung Pass prior to
version ...)
+ TODO: check
+CVE-2022-36875 (Improper restriction of broadcasting Intent in
SaWebViewRelayActivity ...)
+ TODO: check
+CVE-2022-36874 (Improper Handling of Insufficient Permissions or Privileges
vulnerabil ...)
+ TODO: check
+CVE-2022-36873 (Improper restriction of broadcasting Intent in
GalaxyStoreBridgePageLi ...)
+ TODO: check
+CVE-2022-36872 (Pending Intent hijacking vulnerability in SpayNotification in
Samsung ...)
+ TODO: check
+CVE-2022-36871 (Pending Intent hijacking vulnerability in NotiCenterUtils in
Samsung P ...)
+ TODO: check
+CVE-2022-36870 (Pending Intent hijacking vulnerability in
MTransferNotificationManager ...)
+ TODO: check
+CVE-2022-36869 (Improper access control vulnerability in ContactsDumpActivity
of?Conta ...)
+ TODO: check
CVE-2022-36868
RESERVED
-CVE-2022-36867
- RESERVED
-CVE-2022-36866
- RESERVED
-CVE-2022-36865
- RESERVED
-CVE-2022-36864
- RESERVED
-CVE-2022-36863
- RESERVED
-CVE-2022-36862
- RESERVED
-CVE-2022-36861
- RESERVED
-CVE-2022-36860
- RESERVED
-CVE-2022-36859
- RESERVED
-CVE-2022-36858
- RESERVED
-CVE-2022-36857
- RESERVED
-CVE-2022-36856
- RESERVED
-CVE-2022-36855
- RESERVED
-CVE-2022-36854
- RESERVED
-CVE-2022-36853
- RESERVED
-CVE-2022-36852
- RESERVED
-CVE-2022-36851
- RESERVED
-CVE-2022-36850
- RESERVED
-CVE-2022-36849
- RESERVED
-CVE-2022-36848
- RESERVED
-CVE-2022-36847
- RESERVED
-CVE-2022-36846
- RESERVED
-CVE-2022-36845
- RESERVED
-CVE-2022-36844
- RESERVED
-CVE-2022-36843
- RESERVED
-CVE-2022-36842
- RESERVED
-CVE-2022-36841
- RESERVED
+CVE-2022-36867 (Improper access control vulnerability in Editor Lite prior to
version ...)
+ TODO: check
+CVE-2022-36866 (Improper access control vulnerability in Broadcaster in Group
Sharing ...)
+ TODO: check
+CVE-2022-36865 (Improper access control in Group Sharing prior to versions
13.0.6.15 i ...)
+ TODO: check
+CVE-2022-36864 (Improper access control and intent redirection in Samsung
Email prior ...)
+ TODO: check
+CVE-2022-36863 (A heap-based overflow vulnerability in
GetCorrectDbLanguageTypeEsPKc f ...)
+ TODO: check
+CVE-2022-36862 (A heap-based overflow vulnerability in
HWR::EngineCJK::Impl::Construct ...)
+ TODO: check
+CVE-2022-36861 (Custom permission misuse vulnerability in SystemUI prior to
SMR Sep-20 ...)
+ TODO: check
+CVE-2022-36860 (A heap-based overflow vulnerability in LoadEnvironment
function in lib ...)
+ TODO: check
+CVE-2022-36859 (Improper input validation vulnerability in SmartTagPlugin
prior to ver ...)
+ TODO: check
+CVE-2022-36858 (A heap-based overflow vulnerability in
GetCorrectDbLanguageTypeEsPKc() ...)
+ TODO: check
+CVE-2022-36857 (Improper Authorization vulnerability in Photo Editor prior to
SMR Sep- ...)
+ TODO: check
+CVE-2022-36856 (Improper access control vulnerability in Telecom application
prior to ...)
+ TODO: check
+CVE-2022-36855 (A use after free vulnerability in iva_ctl driver prior to SMR
Sep-2022 ...)
+ TODO: check
+CVE-2022-36854 (Out of bound read in libapexjni.media.samsung.so prior to SMR
Sep-2022 ...)
+ TODO: check
+CVE-2022-36853 (Intent redirection in Photo Editor prior to SMR Sep-2022
Release 1 all ...)
+ TODO: check
+CVE-2022-36852 (Improper Authorization vulnerability in Video Editor prior to
SMR Sep- ...)
+ TODO: check
+CVE-2022-36851 (Improper access control vulnerability in Samsung pass prior to
version ...)
+ TODO: check
+CVE-2022-36850 (Path traversal vulnerability in CallBGProvider prior to SMR
Sep-2022 R ...)
+ TODO: check
+CVE-2022-36849 (Use after free vulnerability in sdp_mm_set_process_sensitive
function ...)
+ TODO: check
+CVE-2022-36848 (Improper Authorization vulnerability in setDualDARPolicyCmd
prior to S ...)
+ TODO: check
+CVE-2022-36847 (Use after free vulnerability in mtp_send_signal function of
MTP driver ...)
+ TODO: check
+CVE-2022-36846 (A heap-based overflow vulnerability in ConstructDictionary
function in ...)
+ TODO: check
+CVE-2022-36845 (A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO
function in ...)
+ TODO: check
+CVE-2022-36844 (A heap-based overflow vulnerability in
HWR::EngJudgeModel::Construct() ...)
+ TODO: check
+CVE-2022-36843 (A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO
function in ...)
+ TODO: check
+CVE-2022-36842 (A heap-based overflow vulnerability in prepareRecogLibrary
function in ...)
+ TODO: check
+CVE-2022-36841 (A heap-based overflow vulnerability in
PrepareRecogLibrary_Part functi ...)
+ TODO: check
CVE-2022-36840 (DLL hijacking vulnerability in Samsung Update Setup prior to
version 2 ...)
NOT-FOR-US: Samsung
CVE-2022-36839 (SQL injection vulnerability via IAPService in Samsung Checkout
prior t ...)
@@ -9361,8 +9387,8 @@ CVE-2022-36619 (In D-link DIR-816 A2_v1.10CNB04.img,the
network can be reset wit
NOT-FOR-US: D-link
CVE-2022-36618
RESERVED
-CVE-2022-36617
- RESERVED
+CVE-2022-36617 (Arq Backup 7.19.5.0 and below stores backup encryption
passwords using ...)
+ TODO: check
CVE-2022-36616 (TOTOLINK A810R V4.1.2cu.5182_B20201026 and
V5.9c.4050_B20190424 was di ...)
NOT-FOR-US: TOTOLINK
CVE-2022-36615 (TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to
contain a h ...)
@@ -9738,8 +9764,8 @@ CVE-2022-2530
RESERVED
CVE-2022-2529
RESERVED
-CVE-2022-2528
- RESERVED
+CVE-2022-2528 (In affected versions of Octopus Deploy it is possible to upload
a pack ...)
+ TODO: check
CVE-2022-36439
RESERVED
CVE-2022-36438
@@ -9773,8 +9799,7 @@ CVE-2021-46829 (GNOME GdkPixbuf (aka GDK-PixBuf) before
2.42.8 allows a heap-bas
NOTE:
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/6976bdc8ee9dd2c2954f91066f7b0f643769a379
(2.42.8)
NOTE: https://www.openwall.com/lists/oss-security/2022/07/23/1
NOTE: http://www.openwall.com/lists/oss-security/2022/07/25/1
-CVE-2022-2526 [use-after-free when dealing with DnsStream in
resolved-dns-stream.c]
- RESERVED
+CVE-2022-2526 (A use-after-free vulnerability was found in systemd. This issue
occurs ...)
- systemd 240-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2109926
NOTE:
https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c
(v240)
@@ -10775,8 +10800,8 @@ CVE-2022-36111
RESERVED
CVE-2022-36110
RESERVED
-CVE-2022-36109
- RESERVED
+CVE-2022-36109 (Moby is an open-source project created by Docker to enable
software co ...)
+ TODO: check
CVE-2022-36108
RESERVED
CVE-2022-36107
@@ -15950,8 +15975,8 @@ CVE-2022-34167 (IBM CICS TX Standard and Advanced 11.1
is vulnerable to stored c
NOT-FOR-US: IBM
CVE-2022-34166 (IBM CICS TX Standard and Advanced 11.1 is vulnerable to
cross-site scr ...)
NOT-FOR-US: IBM
-CVE-2022-34165
- RESERVED
+CVE-2022-34165 (IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and
IBM WebSph ...)
+ TODO: check
CVE-2022-34164 (IBM CICS TX 11.1 could allow a local user to impersonate
another legit ...)
NOT-FOR-US: IBM
CVE-2022-34163 (IBM CICS TX 11.1 is vulnerable to HTTP header injection,
caused by imp ...)
@@ -30321,8 +30346,8 @@ CVE-2022-29063 (The Solr plugin of Apache OFBiz is
configured by default to auto
NOT-FOR-US: Apache OFBiz
CVE-2022-29062 (Multiple relative path traversal vulnerabilities [CWE-23] in
Fortinet ...)
NOT-FOR-US: FortiGuard
-CVE-2022-29061
- RESERVED
+CVE-2022-29061 (An improper neutralization of special elements used in an OS
command ( ...)
+ TODO: check
CVE-2022-29060 (A use of hard-coded cryptographic key vulnerability [CWE-321]
in Forti ...)
NOT-FOR-US: Fortinet
CVE-2022-29059
@@ -31112,12 +31137,12 @@ CVE-2022-28744
RESERVED
CVE-2022-28743 (Time-of-check Time-of-use (TOCTOU) Race Condition vulerability
in Fosc ...)
NOT-FOR-US: Foscam R2C IP camera
-CVE-2022-28742
- RESERVED
-CVE-2022-28741
- RESERVED
-CVE-2022-28740
- RESERVED
+CVE-2022-28742 (aEnrich eHRD Learning Management Key Performance Indicator
System 5+ h ...)
+ TODO: check
+CVE-2022-28741 (aEnrich a+HRD 5.x Learning Management Key Performance
Indicator System ...)
+ TODO: check
+CVE-2022-28740 (aEnrich eHRD Learning Management Key Performance Indicator
System 5+ e ...)
+ TODO: check
CVE-2022-28739 (There is a buffer over-read in Ruby before 2.6.10, 2.7.x
before 2.7.6, ...)
- ruby3.0 3.0.4-1 (bug #1009956)
- ruby2.7 <removed> (bug #1009957)
@@ -37995,16 +38020,16 @@ CVE-2022-26396
RESERVED
CVE-2022-26395
RESERVED
-CVE-2022-26394
- RESERVED
-CVE-2022-26393
- RESERVED
-CVE-2022-26392
- RESERVED
+CVE-2022-26394 (The Baxter Spectrum WBM does not perform mutual authentication
with th ...)
+ TODO: check
+CVE-2022-26393 (The Baxter Spectrum WBM is susceptible to format string
attacks via ap ...)
+ TODO: check
+CVE-2022-26392 (The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM
(v17, v1 ...)
+ TODO: check
CVE-2022-26391
RESERVED
-CVE-2022-26390
- RESERVED
+CVE-2022-26390 (The Baxter Spectrum Wireless Battery Module (WBM) stores
network crede ...)
+ TODO: check
CVE-2022-26389
RESERVED
CVE-2022-26388
@@ -55410,7 +55435,7 @@ CVE-2022-21943
RESERVED
CVE-2022-21942
RESERVED
-CVE-2022-21941 (All versions of iSTAR Ultra prior to version 6.8.9.CU01are
vulnerable ...)
+CVE-2022-21941 (All versions of iSTAR Ultra prior to version 6.8.9.CU01 are
vulnerable ...)
NOT-FOR-US: Sensormatic Electronics, LLC
CVE-2022-21940
RESERVED
@@ -56425,8 +56450,8 @@ CVE-2021-44837 (An issue was discovered in Delta RM
1.2. It is possible for an u
NOT-FOR-US: Delta RM
CVE-2021-44836 (An issue was discovered in Delta RM 1.2. The
/risque/risque/workflow/r ...)
NOT-FOR-US: Delta RM
-CVE-2021-44835
- RESERVED
+CVE-2021-44835 (An issue was discovered in Active Intelligent Visualization 5.
The Vdc ...)
+ TODO: check
CVE-2021-44834
RESERVED
CVE-2021-4107 (yetiforcecrm is vulnerable to Improper Neutralization of Input
During ...)
@@ -71493,10 +71518,10 @@ CVE-2021-40650 (In Connx Version 6.2.0.1269
(20210623), a cookie can be issued b
NOT-FOR-US: Connx
CVE-2021-40649 (In Connx Version 6.2.0.1269 (20210623), a cookie can be issued
by the ...)
NOT-FOR-US: Connx
-CVE-2021-40648
- RESERVED
-CVE-2021-40647
- RESERVED
+CVE-2021-40648 (In man2html 1.6g, a filename can be created to overwrite the
previous ...)
+ TODO: check
+CVE-2021-40647 (In man2html 1.6g, a specific string being read in from a file
will ove ...)
+ TODO: check
CVE-2021-40646
RESERVED
CVE-2021-40645 (An SQL Injection vulnerability exists in glorylion JFinalOA as
of 9/7/ ...)
@@ -97094,7 +97119,7 @@ CVE-2021-30561 (Type Confusion in V8 in Google Chrome
prior to 91.0.4472.164 all
[buster] - chromium <end-of-life> (see DSA 5046)
[stretch] - chromium <end-of-life> (see DSA 4562)
CVE-2021-30560 (Use after free in Blink XSLT in Google Chrome prior to
91.0.4472.164 a ...)
- {DSA-5216-1}
+ {DSA-5216-1 DLA-3101-1}
- chromium 93.0.4577.82-1 (bug #990079)
[buster] - chromium <end-of-life> (see DSA 5046)
[stretch] - chromium <end-of-life> (see DSA 4562)
@@ -178362,8 +178387,7 @@ CVE-2020-10736 (An authorization bypass vulnerability
was found in Ceph versions
NOTE: https://ceph.io/releases/v15-2-2-octopus-released/
NOTE:
https://github.com/ceph/ceph/commit/c7e7009a690621aacd4ac2c70c6469f25d692868
(master)
NOTE:
https://github.com/ceph/ceph/commit/f2cf2ce1bd9a86462510a7a12afa4e528b615df2
(v15.2.2)
-CVE-2020-10735
- RESERVED
+CVE-2020-10735 (A flaw was found in python. In algorithms with quadratic time
complexi ...)
- python3.11 <unfixed>
- python3.10 <unfixed>
- python3.9 <unfixed>
@@ -246716,7 +246740,7 @@ CVE-2019-5817 (Heap buffer overflow in ANGLE in
Google Chrome on Windows prior t
CVE-2019-5816 (Process lifetime issue in Chrome in Google Chrome on Android
prior to ...)
- chromium <not-affected> (Android-specific issue)
CVE-2019-5815 (Type confusion in xsltNumberFormatGetMultipleLevel prior to
libxslt 1. ...)
- {DSA-4500-1}
+ {DSA-4500-1 DLA-3101-1}
- chromium 74.0.3729.108-1
[stretch] - chromium <end-of-life> (see DSA 4562)
- libxslt 1.1.34-2
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aeeae369f8e37b33bcc20d91ae51bc2f62c56614
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aeeae369f8e37b33bcc20d91ae51bc2f62c56614
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
