Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
604def06 by Moritz Muehlenhoff at 2023-03-10T11:51:03+01:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -41,7 +41,7 @@ CVE-2023-28006
CVE-2023-28005
RESERVED
CVE-2023-1307 (Authentication Bypass by Primary Weakness in GitHub repository
froxlor ...)
- TODO: check
+ - froxlor <itp> (bug #581792)
CVE-2023-1306
RESERVED
CVE-2023-1305
@@ -49,13 +49,13 @@ CVE-2023-1305
CVE-2023-1304
RESERVED
CVE-2023-1303 (A vulnerability was found in UCMS 1.6 and classified as
critical. This ...)
- TODO: check
+ NOT-FOR-US: UCMS
CVE-2023-1302 (A vulnerability, which was classified as problematic, was found
in Sou ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2023-1301 (A vulnerability, which was classified as critical, has been
found in S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2023-1300 (A vulnerability classified as critical was found in
SourceCodester COV ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2023-1299
RESERVED
CVE-2023-1298
@@ -169,11 +169,11 @@ CVE-2023-1277 (A vulnerability, which was classified as
critical, was found in k
CVE-2018-25081 (** DISPUTED ** Bitwarden through 2023.2.1 offers password
auto-fill wi ...)
NOT-FOR-US: Bitwarden
CVE-2017-20182 (A vulnerability was found in Mobile Vikings Django AJAX
Utilities up t ...)
- TODO: check
+ NOT-FOR-US: Mobile Vikings Django AJAX Utilities
CVE-2014-125093 (A vulnerability has been found in Ad Blocking Detector Plugin
up to 1. ...)
- TODO: check
+ NOT-FOR-US: Ad Blocking Detector Plugin
CVE-2013-10020 (A vulnerability, which was classified as problematic, was
found in MMD ...)
- TODO: check
+ NOT-FOR-US: MMDeveloper
CVE-2023-27970
RESERVED
CVE-2023-27969
@@ -1601,7 +1601,7 @@ CVE-2023-27492
CVE-2023-27491
RESERVED
CVE-2023-27490 (NextAuth.js is an open source authentication solution for
Next.js appl ...)
- TODO: check
+ NOT-FOR-US: NextAuth.js
CVE-2023-27489
RESERVED
CVE-2023-27488
@@ -1613,9 +1613,9 @@ CVE-2023-27486 (xCAT is a toolkit for deployment and
administration of computer
CVE-2023-27485 (thmmniii/fbs-core is an open source feedback system for
students. In v ...)
NOT-FOR-US: thmmniii/fbs-core
CVE-2023-27484 (crossplane-runtime is a set of go libraries used to build
Kubernetes c ...)
- TODO: check
+ NOT-FOR-US: crossplane-runtime
CVE-2023-27483 (crossplane-runtime is a set of go libraries used to build
Kubernetes c ...)
- TODO: check
+ NOT-FOR-US: crossplane-runtime
CVE-2023-27482 (homeassistant is an open source home automation tool. A
remotely explo ...)
- homeassistant <itp> (bug #839786)
CVE-2023-27481 (Directus is a real-time API and App dashboard for managing SQL
databas ...)
@@ -2390,31 +2390,31 @@ CVE-2023-27216
CVE-2023-27215
RESERVED
CVE-2023-27214 (Online Student Management System v1.0 was discovered to
contain multip ...)
- TODO: check
+ NOT-FOR-US: Online Student Management System
CVE-2023-27213 (Online Student Management System v1.0 was discovered to
contain a SQL ...)
- TODO: check
+ NOT-FOR-US: Online Student Management System
CVE-2023-27212 (A cross-site scripting (XSS) vulnerability in
/php-opos/signup.php of ...)
- TODO: check
+ NOT-FOR-US: Online Pizza Ordering System
CVE-2023-27211 (A cross-site scripting (XSS) vulnerability in
/admin/navbar.php of Onl ...)
- TODO: check
+ NOT-FOR-US: Online Pizza Ordering System
CVE-2023-27210 (Online Pizza Ordering System 1.0 was discovered to contain a
SQL injec ...)
- TODO: check
+ NOT-FOR-US: Online Pizza Ordering System
CVE-2023-27209
RESERVED
CVE-2023-27208 (A cross-site scripting (XSS) vulnerability in
/php-opos/login.php of O ...)
- TODO: check
+ NOT-FOR-US: Online Pizza Ordering System
CVE-2023-27207 (Online Pizza Ordering System 1.0 was discovered to contain a
SQL injec ...)
- TODO: check
+ NOT-FOR-US: Online Pizza Ordering System
CVE-2023-27206 (A cross-site scripting (XSS) vulnerability in
/kruxton/navbar.php of B ...)
- TODO: check
+ NOT-FOR-US: Best POS Management System
CVE-2023-27205 (Best POS Management System 1.0 was discovered to contain a SQL
injecti ...)
- TODO: check
+ NOT-FOR-US: Best POS Management System
CVE-2023-27204 (Best POS Management System 1.0 was discovered to contain a SQL
injecti ...)
- TODO: check
+ NOT-FOR-US: Best POS Management System
CVE-2023-27203 (Best POS Management System 1.0 was discovered to contain a SQL
injecti ...)
- TODO: check
+ NOT-FOR-US: Best POS Management System
CVE-2023-27202 (Best POS Management System 1.0 was discovered to contain a SQL
injecti ...)
- TODO: check
+ NOT-FOR-US: Best POS Management System
CVE-2023-27201
RESERVED
CVE-2023-27200
@@ -2904,7 +2904,7 @@ CVE-2023-26959
CVE-2023-26958
RESERVED
CVE-2023-26957 (onekeyadmin v1.3.9 was discovered to contain an arbitrary file
delete ...)
- TODO: check
+ NOT-FOR-US: onekeyadmin
CVE-2023-26956 (onekeyadmin v1.3.9 was discovered to contain an arbitrary file
read vu ...)
NOT-FOR-US: onekeyadmin
CVE-2023-26955 (onekeyadmin v1.3.9 was discovered to contain a stored
cross-site scrip ...)
@@ -5004,9 +5004,9 @@ CVE-2023-26112
CVE-2023-26111 (All versions of the package @nubosoftware/node-static; all
versions of ...)
NOT-FOR-US: @nubosoftware/node-static
CVE-2023-26110 (All versions of the package node-bluetooth are vulnerable to
Buffer Ov ...)
- TODO: check
+ NOT-FOR-US: node-bluetooth
CVE-2023-26109 (All versions of the package node-bluetooth-serial-port are
vulnerable ...)
- TODO: check
+ NOT-FOR-US: node-bluetooth-serial-port
CVE-2023-26108 (Versions of the package @nestjs/core before 9.0.5 are
vulnerable to In ...)
NOT-FOR-US: @nestjs/core
CVE-2023-26107 (All versions of the package sketchsvg are vulnerable to
Arbitrary Code ...)
@@ -5854,7 +5854,7 @@ CVE-2023-25816 (Nextcloud is an Open Source private cloud
software. Versions 25.
CVE-2023-25815
RESERVED
CVE-2023-25814 (metersphere is an open source continuous testing platform. In
versions ...)
- TODO: check
+ NOT-FOR-US: metersphere
CVE-2023-25813 (Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a
SQL inj ...)
NOT-FOR-US: Sequelize
CVE-2023-25812 (Minio is a Multi-Cloud Object Storage framework. Affected
versions do ...)
@@ -6839,7 +6839,7 @@ CVE-2023-25575 (API Platform Core is the server component
of API Platform: hyper
CVE-2023-25574
RESERVED
CVE-2023-25573 (metersphere is an open source continuous testing platform. In
affected ...)
- TODO: check
+ NOT-FOR-US: metersphere
CVE-2023-25572 (react-admin is a frontend framework for building browser
applications ...)
NOT-FOR-US: react-admin
CVE-2023-25571 (Backstage is an open platform for building developer portals.
`@backst ...)
@@ -8333,11 +8333,11 @@ CVE-2023-0625
CVE-2023-0624 (OrangeScrum version 2.0.11 allows an external attacker to
obtain arbit ...)
NOT-FOR-US: OrangeScrum
CVE-2023-0623 (Cscape Envision RV version 4.60 is vulnerable to an
out-of-bounds writ ...)
- TODO: check
+ NOT-FOR-US: Cscape Envision RV
CVE-2023-0622 (Cscape Envision RV version 4.60 is vulnerable to an
out-of-bounds writ ...)
- TODO: check
+ NOT-FOR-US: Cscape Envision RV
CVE-2023-0621 (Cscape Envision RV version 4.60 is vulnerable to an
out-of-bounds read ...)
- TODO: check
+ NOT-FOR-US: Cscape Envision RV
CVE-2023-0620
RESERVED
CVE-2023-25000
@@ -32770,7 +32770,7 @@ CVE-2023-20066
CVE-2023-20065
RESERVED
CVE-2023-20064 (A vulnerability in the GRand Unified Bootloader (GRUB) for
Cisco IOS X ...)
- TODO: check
+ NOT-FOR-US: Cisco's use of GRUB
CVE-2023-20063
RESERVED
CVE-2023-20062 (Multiple vulnerabilities in Cisco Unified Intelligence Center
could al ...)
@@ -32803,7 +32803,7 @@ CVE-2023-20051
CVE-2023-20050 (A vulnerability in the CLI of Cisco NX-OS Software could allow
an auth ...)
NOT-FOR-US: Cisco
CVE-2023-20049 (A vulnerability in the bidirectional forwarding detection
(BFD) hardwa ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2023-20048
RESERVED
CVE-2023-20047 (A vulnerability in the Link Layer Discovery Protocol (LLDP)
feature of ...)
@@ -74298,7 +74298,7 @@ CVE-2022-29058 (An improper neutralization of special
elements [CWE-89] used in
CVE-2022-29057 (A improper neutralization of input during web page generation
('cross- ...)
NOT-FOR-US: Fortinet
CVE-2022-29056 (A improper restriction of excessive authentication attempts
vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2022-29055 (A access of uninitialized pointer in Fortinet FortiOS version
7.2.0, 7 ...)
NOT-FOR-US: FortiGuard
CVE-2022-29054 (A missing cryptographic steps vulnerability [CWE-325] in the
functions ...)
@@ -83266,7 +83266,7 @@ CVE-2022-25907 (The package ts-deepmerge before 2.0.2
are vulnerable to Prototyp
CVE-2022-25906 (All versions of the package is-http2 are vulnerable to Command
Injecti ...)
NOT-FOR-US: Node is-http2
CVE-2022-25904 (All versions of package safe-eval are vulnerable to Prototype
Pollutio ...)
- TODO: check
+ NOT-FOR-US: Node safe-eval
CVE-2022-25903 (The package opcua from 0.0.0 are vulnerable to Denial of
Service (DoS) ...)
NOT-FOR-US: Rust crate opcua
CVE-2022-25902
@@ -83381,7 +83381,7 @@ CVE-2022-25855 (All versions of the package
create-choo-app3 are vulnerable to C
CVE-2022-25854 (This affects the package @yaireo/tagify before 4.9.8. The
package is u ...)
NOT-FOR-US: Tagify
CVE-2022-25853 (All versions of the package semver-tags are vulnerable to
Command Inje ...)
- TODO: check
+ NOT-FOR-US: Node semver-tags
CVE-2022-25852 (All versions of package pg-native; all versions of package
libpq are v ...)
NOT-FOR-US: Node pgnative
CVE-2022-25851 (The package jpeg-js before 0.4.4 are vulnerable to Denial of
Service ( ...)
@@ -83391,9 +83391,9 @@ CVE-2022-25850 (The package
github.com/hoppscotch/proxyscotch before 1.0.0 are v
CVE-2022-25849 (The package joyqi/hyper-down from 0.0.0 are vulnerable to
Cross-site S ...)
NOT-FOR-US: joyqi/hyper-down
CVE-2022-25848 (This affects all versions of package static-dev-server. This
is becaus ...)
- TODO: check
+ NOT-FOR-US: static-dev-server
CVE-2022-25847 (All versions of the package serve-lite are vulnerable to
Cross-site Sc ...)
- TODO: check
+ NOT-FOR-US: serve-lite
CVE-2022-25846
RESERVED
CVE-2022-25845 (The package com.alibaba:fastjson before 1.2.83 are vulnerable
to Deser ...)
@@ -83456,7 +83456,7 @@ CVE-2022-25352 (The package libnested before 1.5.2 are
vulnerable to Prototype P
CVE-2022-25351
RESERVED
CVE-2022-25350 (All versions of the package puppet-facter are vulnerable to
Command In ...)
- TODO: check
+ NOT-FOR-US: Node puppet-facter (different from src:facter)
CVE-2022-25349 (All versions of package materialize-css are vulnerable to
Cross-site S ...)
- materialize <unfixed> (bug #1014727)
NOTE: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2766498
@@ -83490,7 +83490,7 @@ CVE-2022-25232
CVE-2022-25231 (The package node-opcua before 2.74.0 are vulnerable to Denial
of Servi ...)
NOT-FOR-US: node-opcua/node-opcua
CVE-2022-25171 (The package p4 before 0.0.7 are vulnerable to Command
Injection via th ...)
- TODO: check
+ NOT-FOR-US: Node p4
CVE-2022-24913 (Versions of the package com.fasterxml.util:java-merge-sort
before 1.1. ...)
NOT-FOR-US: com.fasterxml.util:java-merge-sort
CVE-2022-24912 (The package
github.com/runatlantis/atlantis/server/controllers/events ...)
@@ -83521,7 +83521,7 @@ CVE-2022-24434 (This affects all versions of package
dicer. A malicious attacker
CVE-2022-24433 (The package simple-git before 3.3.0 are vulnerable to Command
Injectio ...)
NOT-FOR-US: simple-git
CVE-2022-24431 (All versions of package abacus-ext-cmdline are vulnerable to
Command I ...)
- TODO: check
+ NOT-FOR-US: abacus-ext-cmdline
CVE-2022-24430
RESERVED
CVE-2022-24429 (The package convert-svg-core before 0.6.3 are vulnerable to
Arbitrary ...)
@@ -83529,7 +83529,7 @@ CVE-2022-24429 (The package convert-svg-core before
0.6.3 are vulnerable to Arbi
CVE-2022-24381 (All versions of package asneg/opcuastack are vulnerable to
Denial of S ...)
NOT-FOR-US: ASNeG/OpcUaStack
CVE-2022-24377 (The package cycle-import-check before 1.3.2 are vulnerable to
Command ...)
- TODO: check
+ NOT-FOR-US: cycle-import-check
CVE-2022-24376 (All versions of package git-promise are vulnerable to Command
Injectio ...)
NOT-FOR-US: Node git-promise
CVE-2022-24375 (The package node-opcua before 2.74.0 are vulnerable to Denial
of Servi ...)
@@ -83572,7 +83572,7 @@ CVE-2022-22138 (All versions of package
fast-string-search are vulnerable to Den
CVE-2022-21811
RESERVED
CVE-2022-21810 (All versions of the package smartctl are vulnerable to Command
Injecti ...)
- TODO: check
+ NOT-FOR-US: Node smartctl
CVE-2022-21803 (This affects the package nconf before 0.11.4. When using the
memory en ...)
NOT-FOR-US: node nconf
CVE-2022-21802 (The package grapesjs before 0.19.5 are vulnerable to
Cross-site Script ...)
@@ -83624,7 +83624,7 @@ CVE-2022-21208 (The package node-opcua before 2.74.0
are vulnerable to Denial of
CVE-2022-21195 (All versions of package url-regex are vulnerable to Regular
Expression ...)
NOT-FOR-US: AlexFlipnote/url_regex
CVE-2022-21192 (All versions of the package serve-lite are vulnerable to
Directory Tra ...)
- TODO: check
+ NOT-FOR-US: serve-lite
CVE-2022-21191 (Versions of the package global-modules-path before 3.0.0 are
vulnerabl ...)
NOT-FOR-US: Node global-modules-path
CVE-2022-21190 (This affects the package convict before 6.2.3. This is a
bypass of [CV ...)
@@ -83688,9 +83688,9 @@ CVE-2022-0744
CVE-2022-25838 (Laravel Fortify before 1.11.1 allows reuse within a short time
window, ...)
NOT-FOR-US: Laravel Fortify
CVE-2022-25837 (Bluetooth® Pairing in Bluetooth Core Specification v1.0B
through ...)
- TODO: check
+ NOT-FOR-US: Bluetooth protocol issue
CVE-2022-25836 (Bluetooth® Low Energy Pairing in Bluetooth Core
Specification v4. ...)
- TODO: check
+ NOT-FOR-US: Bluetooth protocol issue
CVE-2022-25835
RESERVED
CVE-2022-25834
@@ -91372,7 +91372,7 @@ CVE-2022-23525 (Helm is a tool for managing Charts,
pre-configured Kubernetes re
CVE-2022-23524 (Helm is a tool for managing Charts, pre-configured Kubernetes
resource ...)
- helm-kubernetes <itp> (bug #910799)
CVE-2022-23523 (In versions prior to 0.8.1, the linux-loader crate uses the
offsets an ...)
- TODO: check
+ NOT-FOR-US: Rust crate linux-loader
CVE-2022-23522
RESERVED
CVE-2022-23521 (Git is distributed revision control system. gitattributes are
a mechan ...)
@@ -91450,7 +91450,7 @@ CVE-2022-23501 (TYPO3 is an open source PHP based web
content management system.
CVE-2022-23500 (TYPO3 is an open source PHP based web content management
system. In ve ...)
NOT-FOR-US: Typo3
CVE-2022-23499 (HTML sanitizer is written in PHP, aiming to provide XSS-safe
markup ba ...)
- TODO: check
+ NOT-FOR-US: Typo3 extension
CVE-2022-23498 (Grafana is an open-source platform for monitoring and
observability. W ...)
- grafana <not-affected> (Specific to Grafana Enterprise)
CVE-2022-23497 (FreshRSS is a free, self-hostable RSS aggregator. User
configuration f ...)
@@ -91544,7 +91544,7 @@ CVE-2022-23467 (OpenRazer is an open source driver and
user-space daemon to cont
CVE-2022-23466 (teler is an real-time intrusion detection and threat alert
dashboard. ...)
NOT-FOR-US: teler
CVE-2022-23465 (SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit
a94e6b24 ...)
- TODO: check
+ NOT-FOR-US: SwiftTerm
CVE-2022-23464 (Nepxion Discovery is a solution for Spring Cloud. Discovery is
vulnera ...)
NOT-FOR-US: Nepxion
CVE-2022-23463 (Nepxion Discovery is a solution for Spring Cloud. Discover is
vulnerab ...)
@@ -123940,7 +123940,7 @@ CVE-2021-37504 (A cross-site scripting (XSS)
vulnerability in the fileNameStr pa
CVE-2021-37503
RESERVED
CVE-2021-37502 (Cross Site Scripting (XSS) vulnerability in automad 1.7.5
allows remot ...)
- TODO: check
+ NOT-FOR-US: automad
CVE-2021-37501 (Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0
through 1 ...)
TODO: check
CVE-2021-37500 (Directory traversal vulnerability in Reprise License Manager
(RLM) web ...)
@@ -124496,7 +124496,7 @@ CVE-2021-37236
CVE-2021-37235
RESERVED
CVE-2021-37234 (Incorrect Access Control vulnerability in Modern Honey Network
commit ...)
- TODO: check
+ NOT-FOR-US: Modern Honey Network
CVE-2021-37233
RESERVED
CVE-2021-37232 (A stack overflow vulnerability occurs in Atomicparsley
20210124.204813 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/604def06ae770af73df3bd208cf7ea323d77e9e8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/604def06ae770af73df3bd208cf7ea323d77e9e8
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
