Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d637c64e by Moritz Muehlenhoff at 2023-02-16T16:34:09+01:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -19636,13 +19636,13 @@ CVE-2022-45548 (AyaCMS v3.1.2 has an Arbitrary File
Upload vulnerability. ...)
CVE-2022-45547
RESERVED
CVE-2022-45546 (Information Disclosure in Authentication Component of
ScreenCheck Badg ...)
- TODO: check
+ NOT-FOR-US: ScreenCheck BadgeMaker
CVE-2022-45545
RESERVED
CVE-2022-45544 (Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS
2.2.7-2 ...)
NOT-FOR-US: Schlix Web Inc SCHLIX CMS
CVE-2022-45543 (Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows
attacke ...)
- TODO: check
+ NOT-FOR-US: DiscuzX
CVE-2022-45542 (EyouCMS <= 1.6.0 was discovered a reflected-XSS in the
FileManager ...)
NOT-FOR-US: EyouCMS
CVE-2022-45541 (EyouCMS <= 1.6.0 was discovered a reflected-XSS in the
article attr ...)
@@ -19982,9 +19982,9 @@ CVE-2022-45457
CVE-2022-45456
RESERVED
CVE-2022-45455 (Local privilege escalation due to incomplete uninstallation
cleanup. T ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2022-45454 (Sensitive information disclosure due to insecure folder
permissions. T ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2022-45453
RESERVED
CVE-2022-45452
@@ -20090,9 +20090,9 @@ CVE-2022-45439 (A pair of spare WiFi credentials is
stored in the configuration
CVE-2022-45438 (When explicitly enabling the feature flag DASHBOARD_CACHE
(disabled by ...)
NOT-FOR-US: Apache Superset
CVE-2022-45437 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2022-45436 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2022-4003
RESERVED
CVE-2022-4002
@@ -20711,7 +20711,7 @@ CVE-2022-45287
CVE-2022-45286
RESERVED
CVE-2022-45285 (Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and
1.9.1 is ...)
- TODO: check
+ NOT-FOR-US: Vsourz Digital Advanced Contact form
CVE-2022-45284
RESERVED
CVE-2022-45283 (GPAC MP4box v2.0.0 was discovered to contain a stack overflow
in the s ...)
@@ -21084,7 +21084,7 @@ CVE-2022-45156
CVE-2022-45155
RESERVED
CVE-2022-45154 (A Cleartext Storage of Sensitive Information vulnerability in
suppport ...)
- TODO: check
+ NOT-FOR-US: SuSE supportutils
CVE-2022-45153 (An Incorrect Default Permissions vulnerability in
saphanabootstrap-for ...)
NOT-FOR-US: SAP
CVE-2022-45152 (A blind Server-Side Request Forgery (SSRF) vulnerability was
found in ...)
@@ -23216,7 +23216,7 @@ CVE-2023-20951
CVE-2023-20950
RESERVED
CVE-2023-20949 (In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a
possible out ...)
- TODO: check
+ NOT-FOR-US: Linux kernel of the Pixel phone
CVE-2023-20948
RESERVED
NOT-FOR-US: Android
@@ -23280,7 +23280,7 @@ CVE-2023-20928 (In binder_vma_close of binder.c, there
is a possible use after f
NOTE: https://source.android.com/docs/security/bulletin/2023-01-01
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=2374
CVE-2023-20927 (In permissions of AndroidManifest.xml, there is a possible way
to gran ...)
- TODO: check
+ NOT-FOR-US: Android
CVE-2023-20926
RESERVED
CVE-2023-20925 (In setUclampMinLocked of PowerSessionManager.cpp, there is a
possible ...)
@@ -28226,7 +28226,7 @@ CVE-2022-43472
CVE-2022-43471
RESERVED
CVE-2022-43469 (Cross-Site Request Forgery (CSRF) vulnerability in
Orchestrated Corona ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-43463 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Cust ...)
NOT-FOR-US: WordPress plugin
CVE-2022-43462 (Auth. SQL Injection (SQLi) vulnerability in Adeel Ahmed's IP
Blacklist ...)
@@ -30595,7 +30595,7 @@ CVE-2022-3445 (Use after free in Skia in Google Chrome
prior to 106.0.5249.119 a
- chromium 106.0.5249.119-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2022-42735 (Improper Privilege Management vulnerability in Apache Software
Foundat ...)
- TODO: check
+ NOT-FOR-US: Apache ShenYu
CVE-2022-42734 (A vulnerability has been identified in syngo Dynamics (All
versions &l ...)
NOT-FOR-US: syngo Dynamics
CVE-2022-42733 (A vulnerability has been identified in syngo Dynamics (All
versions &l ...)
@@ -31311,7 +31311,7 @@ CVE-2022-42457 (Generex CS141 through 2.10 allows
remote command execution by ad
CVE-2022-42456
RESERVED
CVE-2022-42455 (ASUS EC Tool driver (aka d.sys)
1beb15c90dcf7a5234ed077833a0a3e900969b ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2022-42454 (Insights for Vulnerability Remediation (IVR) is vulnerable to
man-in-t ...)
NOT-FOR-US: HCL
CVE-2022-42453 (There are insufficient warnings when a Fixlet is imported by a
user. T ...)
@@ -32613,7 +32613,7 @@ CVE-2022-41955 (Autolab is a course management service,
initially developed by a
CVE-2022-41954 (MPXJ is an open source library to read and write project plans
from a ...)
NOT-FOR-US: MPXJ
CVE-2022-41953 (Git GUI is a convenient graphical tool that comes with Git for
Windows ...)
- TODO: check
+ NOT-FOR-US: Git for Windows
CVE-2022-41952 (Synapse before 1.52.0 with URL preview functionality enabled
will atte ...)
- matrix-synapse 1.53.0-1
NOTE:
https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h
@@ -33594,7 +33594,7 @@ CVE-2022-41136 (Cross-Site Request Forgery (CSRF)
vulnerability leading to Store
CVE-2022-41135 (Unauth. Plugin Settings Change vulnerability in Modula plugin
<= 2. ...)
NOT-FOR-US: WordPress plugin
CVE-2022-41134 (Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly –
Exit In ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-41132 (Unauthenticated Plugin Settings Change Leading To Stored XSS
Vulnerabi ...)
NOT-FOR-US: WordPress plugin
CVE-2022-40975
@@ -33713,7 +33713,7 @@ CVE-2022-41566
CVE-2022-41565
RESERVED
CVE-2022-41564 (The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk
and TIB ...)
- TODO: check
+ NOT-FOR-US: TIBCO
CVE-2022-41563 (The Dashboard component of TIBCO Software Inc.'s TIBCO
JasperReports S ...)
NOT-FOR-US: TIBCO
CVE-2022-41562 (The HTML escaping component of TIBCO Software Inc.'s TIBCO
JasperRepor ...)
@@ -35864,7 +35864,7 @@ CVE-2022-40713 (An issue was discovered in NOKIA
1350OMS R14.2. Multiple Relativ
CVE-2022-40712 (An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS
exists u ...)
NOT-FOR-US: NOKIA
CVE-2022-40711 (PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End
Entity s ...)
- TODO: check
+ NOT-FOR-US: PrimeKey EJBCA
CVE-2022-40710 (A link following vulnerability in Trend Micro Deep Security 20
and Clo ...)
NOT-FOR-US: Trend Micro
CVE-2022-40709 (An Out-of-bounds read vulnerability in Trend Micro Deep
Security 20 an ...)
@@ -37590,7 +37590,7 @@ CVE-2022-40023 (Sqlalchemy mako before 1.2.2 is
vulnerable to Regular expression
NOTE:
https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
(rel_1_2_2)
NOTE: https://github.com/sqlalchemy/mako/issues/366
CVE-2022-40022 (Microchip Technology (Microsemi) SyncServer S650 was
discovered to con ...)
- TODO: check
+ NOT-FOR-US: Microchip Technology
CVE-2022-40021
RESERVED
CVE-2022-40020
@@ -37602,7 +37602,7 @@ CVE-2022-40018
CVE-2022-40017
RESERVED
CVE-2022-40016 (Use After Free (UAF) vulnerability in ireader media-server
before comm ...)
- TODO: check
+ NOT-FOR-US: ireader media-server
CVE-2022-40015
RESERVED
CVE-2022-40014
@@ -39038,7 +39038,7 @@ CVE-2022-39382 (Keystone is a headless CMS for Node.js
— built with GraphQ
CVE-2022-39381 (Muhammara is a node module with c/cpp bindings to modify PDF
with js f ...)
NOT-FOR-US: Muhammara Nodejs module
CVE-2022-39380 (Wire web-app is part of Wire communications. Versions prior to
2022-11 ...)
- TODO: check
+ NOT-FOR-US: Wire webapp
CVE-2022-39379 (Fluentd collects events from various data sources and writes
them to f ...)
- fluentd <itp> (bug #926692)
CVE-2022-39378 (Discourse is a platform for community discussion. Under
certain condit ...)
@@ -39702,7 +39702,7 @@ CVE-2022-3091 (RONDS EPM version 1.19.5 has a
vulnerability in which a function
CVE-2022-3090 (Red Lion Controls Crimson 3.0 versions 707.000 and prior,
Crimson 3.1 ...)
NOT-FOR-US: Red Lion Controls Crimson
CVE-2022-3089 (Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext
credent ...)
- TODO: check
+ NOT-FOR-US: Echelon
CVE-2022-3088 (UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100
System Imag ...)
NOT-FOR-US: Moxa
CVE-2022-3087 (Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and
prior are ...)
@@ -40352,7 +40352,7 @@ CVE-2022-38937
CVE-2022-38936 (An issue has been found in PBC through 2022-8-27. A SEGV issue
detecte ...)
NOT-FOR-US: PBC
CVE-2022-38935 (An issue was discovered in NiterForum version 2.5.0-beta in
/src/main/ ...)
- TODO: check
+ NOT-FOR-US: NiterForum
CVE-2022-38934 (readelf in ToaruOS 2.0.1 has some arbitrary address read
vulnerabiliti ...)
NOT-FOR-US: readelf in ToaruOS
CVE-2022-38933
@@ -40486,9 +40486,9 @@ CVE-2022-38870 (Free5gc v3.2.1 is vulnerable to
Information disclosure. ...)
CVE-2022-38869
RESERVED
CVE-2022-38868 (SQL Injection vulnerability in Ehoney version 2.0.0 in
models/protocol ...)
- TODO: check
+ NOT-FOR-US: Ehoney
CVE-2022-38867 (SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1,
and 4.0.2 ...)
- TODO: check
+ NOT-FOR-US: rttys
CVE-2022-38866 (Certain The MPlayer Project products are vulnerable to Buffer
Overflow ...)
{DLA-3255-1}
- mplayer 2:1.5+svn38408-1 (unimportant)
@@ -40820,13 +40820,13 @@ CVE-2022-38779
CVE-2022-38778 (A flaw (CVE-2022-38900) was discovered in one of
Kibana’s third ...)
TODO: check
CVE-2022-38777 (An issue was discovered in the rollback feature of Elastic
Endpoint Se ...)
- TODO: check
+ NOT-FOR-US: Elastic Endpoint Security
CVE-2022-38776
RESERVED
CVE-2022-38775 (An issue was discovered in the rollback feature of Elastic
Endpoint Se ...)
- TODO: check
+ NOT-FOR-US: Elastic Endpoint Security
CVE-2022-38774 (An issue was discovered in the quarantine feature of Elastic
Endpoint ...)
- TODO: check
+ NOT-FOR-US: Elastic Endpoint Security
CVE-2022-38773 (Affected devices do not contain an Immutable Root of Trust in
Hardware ...)
NOT-FOR-US: Siemens
CVE-2022-3010
@@ -40977,7 +40977,7 @@ CVE-2022-2989 (An incorrect handling of the
supplementary groups in the Podman c
NOTE:
https://github.com/containers/podman/commit/21540161f20daffd884eba99b2cc31373c9a0ec4
(v4.2.0-rhel)
NOTE:
https://github.com/containers/podman/commit/5c7f28336171f0a5137edd274e45608120d31289
(v4.3.0-rc1)
CVE-2022-2988 (A CWE-787: Out-of-bounds Write vulnerability exists that could
cause s ...)
- TODO: check
+ NOT-FOR-US: Schneider
CVE-2022-2987 (The Ldap WP Login / Active Directory Integration WordPress
plugin befo ...)
NOT-FOR-US: WordPress plugin
CVE-2022-2986 (Enabling and disabling installed H5P libraries did not include
the nec ...)
@@ -41278,7 +41278,7 @@ CVE-2022-38659 (In specific scenarios, on Windows the
operator credentials may b
CVE-2022-38658 (BigFix deployments that have installed the Notification
Service on Win ...)
NOT-FOR-US: HCL
CVE-2022-38657 (An open redirect to malicious sites can occur when accessing
the "Feed ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2022-38656 (HCL Commerce, when using Elasticsearch, can allow a remote
attacker to ...)
NOT-FOR-US: HCL
CVE-2022-38655 (BigFix WebUI non-master operators are missing controls that
prevent th ...)
@@ -43066,11 +43066,11 @@ CVE-2022-38114 (This vulnerability occurs when a web
server fails to correctly p
CVE-2022-38113 (This vulnerability discloses build and services versions in
the server ...)
NOT-FOR-US: Solarwinds
CVE-2022-38112 (In DPA 2022.4 and older releases, generated heap memory dumps
contain ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2022-38111 (SolarWinds Platform was susceptible to the Deserialization of
Untruste ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2022-38110 (In Database Performance Analyzer (DPA) 2022.4 and older
releases, cert ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2022-38109
RESERVED
CVE-2022-38108 (SolarWinds Platform was susceptible to the Deserialization of
Untruste ...)
@@ -43640,7 +43640,7 @@ CVE-2022-2714 (Improper Handling of Length Parameter
Inconsistency in GitHub rep
CVE-2022-2713 (Insufficient Session Expiration in GitHub repository
cockpit-hq/cockpi ...)
NOT-FOR-US: Cockpit-HQ/Cockpit
CVE-2022-2712 (In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a
vulnerability ...)
- TODO: check
+ - glassfish <removed>
CVE-2022-2711 (The Import any XML or CSV File to WordPress plugin before 3.6.9
is not ...)
NOT-FOR-US: WordPress plugin
CVE-2022-2710 (The Scroll To Top WordPress plugin before 1.4.1 does not escape
some o ...)
@@ -43951,9 +43951,9 @@ CVE-2022-37721 (PyroCMS 3.9 is vulnerable to a stored
Cross Site Scripting (XSS_
CVE-2022-37720 (Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site
Scriptin ...)
NOT-FOR-US: Orchard CMS
CVE-2022-37719 (A Cross-Site Request Forgery (CSRF) in the management portal
of JetNex ...)
- TODO: check
+ NOT-FOR-US: JetNexus
CVE-2022-37718 (The management portal component of JetNexus/EdgeNexus ADC
4.2.8 was di ...)
- TODO: check
+ NOT-FOR-US: JetNexus
CVE-2022-37717
RESERVED
CVE-2022-37716
@@ -44751,7 +44751,7 @@ CVE-2022-36350 (Stored cross-site scripting
vulnerability in PukiWiki versions 1
CVE-2022-2667 (A vulnerability was found in SourceCodester Loan Management
System and ...)
NOT-FOR-US: SourceCodester
CVE-2022-2666 (A vulnerability has been found in SourceCodester Loan
Management Syste ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2022-2665 (A vulnerability classified as critical was found in
SourceCodester Sim ...)
NOT-FOR-US: SourceCodester
CVE-2022-2664 (A vulnerability classified as critical has been found in
Private Cloud ...)
@@ -45802,9 +45802,9 @@ CVE-2022-37035 (An issue was discovered in bgpd in
FRRouting (FRR) 8.3. In bgp_n
NOTE: https://github.com/FRRouting/frr/pull/11926
NOTE:
https://github.com/FRRouting/frr/commit/71ca5b09bc71e8cbe38177cf41e83fe164e52eee
CVE-2022-37034 (In dotCMS 5.x-22.06, it is possible to call the TempResource
multiple ...)
- TODO: check
+ NOT-FOR-US: dotCMS
CVE-2022-37033 (In dotCMS 5.x-22.06, TempFileAPI allows a user to create a
temporary f ...)
- TODO: check
+ NOT-FOR-US: dotCMS
CVE-2022-37032 (An out-of-bounds read in the BGP daemon of FRRouting FRR
before 8.4 ma ...)
{DLA-3211-1}
- frr 8.4.1-1 (bug #1021016)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d637c64e487f366aac6b985a9acb1708de7a1423
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d637c64e487f366aac6b985a9acb1708de7a1423
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
