Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7376c9e1 by Moritz Mühlenhoff at 2023-05-23T11:14:25+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,41 +1,41 @@
CVE-2023-31996 (Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command
Injection ...)
- TODO: check
+ NOT-FOR-US: Hanwha
CVE-2023-31995 (Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross
Site Script ...)
- TODO: check
+ NOT-FOR-US: Hanwha
CVE-2023-31994 (Certain Hanwha products are vulnerable to Denial of Service
(DoS). ck ...)
- TODO: check
+ NOT-FOR-US: Hanwha
CVE-2023-31826 (Skyscreamer Open Source Nevado JMS v1.3.2 does not perform
security ch ...)
- TODO: check
+ NOT-FOR-US: Skyscreamer Open Source Nevado JMS
CVE-2023-31816 (IT Sourcecode Content Management System Project In PHP and
MySQL With ...)
- TODO: check
+ NOT-FOR-US: IT Sourcecode Content Management System Project
CVE-2023-31814 (D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is
vulnerable to Fil ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2023-31741 (There is a command injection vulnerability in the Linksys
E2000 router ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2023-31740 (There is a command injection vulnerability in the Linksys
E2000 router ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2023-31708 (A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows
attackers ...)
- TODO: check
+ NOT-FOR-US: EyouCMS
CVE-2023-31670 (An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile
1.0.32, and ...)
TODO: check
CVE-2023-31664 (A reflected cross-site scripting (XSS) vulnerability in
/authenticatio ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2023-2845 (Improper Access Control in GitHub repository
cloudexplorer-dev/cloudex ...)
- TODO: check
+ NOT-FOR-US: Cloudexplorer
CVE-2023-2844 (Missing Authorization in GitHub repository
cloudexplorer-dev/cloudexpl ...)
- TODO: check
+ NOT-FOR-US: Cloudexplorer
CVE-2023-2505 (The affected products have a CSRF vulnerability that could
allow an at ...)
- TODO: check
+ NOT-FOR-US: Birddog
CVE-2023-2504 (Files present on firmware images could allow an attacker to
gain unaut ...)
- TODO: check
+ NOT-FOR-US: Birddog
CVE-2023-27388 (Improper authentication vulnerability in T&D Corporation and
ESPEC MIC ...)
- TODO: check
+ NOT-FOR-US: T&D Corporation
CVE-2023-27387 (Cross-site request forgery (CSRF) in T&D Corporation and ESPEC
MIC COR ...)
- TODO: check
+ NOT-FOR-US: T&D Corporation
CVE-2023-23545 (Missing authentication for critical function exists in T&D
Corporation ...)
- TODO: check
+ NOT-FOR-US: T&D Corporation
CVE-2023-22654 (Client-side enforcement of server-side security issue exists
in T&D Co ...)
- TODO: check
+ NOT-FOR-US: T&D Corporation
CVE-2023-33294 (An issue was discovered in KaiOS 3.0 before 3.1. The
/system/bin/tctwe ...)
NOT-FOR-US: KaiOS
CVE-2023-33293 (An issue was discovered in KaiOS 3.0 and 3.1. The binary
/system/kaios ...)
@@ -53,13 +53,13 @@ CVE-2023-32346 (Teltonika\u2019s Remote Management System
versions prior to 4.10
CVE-2023-31923 (Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure
Permissions. A v ...)
NOT-FOR-US: Suprema BioStar
CVE-2023-31779 (Wekan v6.84 and earlier is vulnerable to Cross Site Scripting
(XSS). A ...)
- TODO: check
+ NOT-FOR-US: Wekan
CVE-2023-31742 (There is a command injection vulnerability in the Linksys
WRT54GL rout ...)
NOT-FOR-US: Linksys
CVE-2023-31689 (In Wcms 0.3.2, an attacker can send a crafted request from a
vulnerabl ...)
NOT-FOR-US: Wcms
CVE-2023-31584 (GitHub repository cu/silicon commit a9ef36 was discovered to
contain a ...)
- TODO: check
+ NOT-FOR-US: cu/silicon
CVE-2023-2840 (NULL Pointer Dereference in GitHub repository gpac/gpac prior
to 2.2.2 ...)
- gpac <unfixed>
NOTE: https://huntr.dev/bounties/21926fc2-6eb1-4e24-8a36-e60f487d0257/
@@ -102,13 +102,13 @@ CVE-2023-33285 (An issue was discovered in Qt 5.x before
5.15.14, 6.x before 6.2
CVE-2023-33281 (The remote keyfob system on Nissan Sylphy Classic 2021 sends
the same ...)
NOT-FOR-US: Nissan Sylphy Classic 2021
CVE-2023-33264 (In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through
5.2.3, ...)
- TODO: check
+ NOT-FOR-US: Kazelcast
CVE-2023-33254 (There is an LDAP bind credentials exposure on KACE Systems
Deployment ...)
- TODO: check
+ NOT-FOR-US: KACE
CVE-2023-33252 (iden3 snarkjs through 0.6.11 allows double spending because
there is n ...)
- TODO: check
+ NOT-FOR-US: iden3 snarkjs
CVE-2023-33251 (When Akka HTTP before 10.5.2 accepts file uploads via the
FileUploadDi ...)
- NOT-FOR-US: Akka
+ NOT-FOR-US: Akka HTTP
CVE-2023-33250 (The Linux kernel 6.3 has a use-after-free in
iopt_unmap_iova_range in ...)
- linux <unfixed>
NOTE: https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ
@@ -181,7 +181,7 @@ CVE-2023-2815 (A vulnerability classified as critical was
found in SourceCodeste
CVE-2023-2814 (A vulnerability classified as problematic has been found in
SourceCode ...)
NOT-FOR-US: SourceCodester Class Scheduling System
CVE-2023-2806 (A vulnerability classified as problematic was found in Weaver
e-cology ...)
- TODO: check
+ NOT-FOR-US: Weaver e-cology
CVE-2023-2804
- libjpeg-turbo <not-affected> (Vulnerable code not present)
NOTE: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/675
@@ -1600,7 +1600,7 @@ CVE-2023-28412 (When supplied with a random MAC address,
Snap One OvrC cloud ser
CVE-2023-28386 (Snap One OvrC Pro devices versions 7.2 and prior do not
validate firmw ...)
NOT-FOR-US: Snap One
CVE-2023-25183 (In Snap One OvrC Pro versions prior to 7.2, when logged into
the super ...)
- TODO: check
+ NOT-FOR-US: Snap One
CVE-2023-2319 (It was discovered that an update for PCS package in
RHBA-2023:2151 err ...)
NOT-FOR-US: ed Hat Enterprise Linux 9.2 specific security regression
from CVE-2023-28154
CVE-2023-2318
@@ -1723,7 +1723,7 @@ CVE-2023-2297 (The Profile Builder \u2013 User Profile &
User Registration Forms
CVE-2023-2296
RESERVED
CVE-2022-4945 (The Dataprobe cloud usernames and passwords are stored in plain
text i ...)
- TODO: check
+ NOT-FOR-US: Dataprobe
CVE-2022-48480
RESERVED
CVE-2022-48479
@@ -4241,7 +4241,7 @@ CVE-2023-1975 (Insertion of Sensitive Information Into
Sent Data in GitHub repos
CVE-2023-1974 (Exposure of Sensitive Information Through Metadata in GitHub
repositor ...)
NOT-FOR-US: answer
CVE-2023-30469 (Cross-site Scripting vulnerability in Hitachi Ops Center
Analyzer (Hit ...)
- TODO: check
+ NOT-FOR-US: Hitachi
CVE-2023-30468
RESERVED
CVE-2023-1973
@@ -5439,7 +5439,7 @@ CVE-2023-29921 (PowerJob V4.3.1 is vulnerable to
Incorrect Access Control via th
CVE-2023-29920
RESERVED
CVE-2023-29919 (SolarView Compact <= 6.0 is vulnerable to Insecure
Permissions. Any fi ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-29918 (RosarioSIS 10.8.4 is vulnerable to CSV injection via the
Periods Modul ...)
NOT-FOR-US: RosarioSIS
CVE-2023-29917 (H3C Magic R200 version R200V100R004 was discovered to contain
a stack ...)
@@ -10200,17 +10200,17 @@ CVE-2023-28415
CVE-2023-28414 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Apex ...)
NOT-FOR-US: WordPress plugin
CVE-2023-28413 (Directory traversal vulnerability in Snow Monkey Forms
versions v5.0.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-28409 (Unrestricted upload of file with dangerous type exists in MW
WP Form v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-28408 (Directory traversal vulnerability in MW WP Form versions
v4.4.2 and ea ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-28394 (Beekeeper Studio versions prior to 3.9.9 allows a remote
authenticated ...)
- TODO: check
+ NOT-FOR-US: Beekeeper Studio
CVE-2023-28392 (Wi-Fi AP UNIT AC-WAPU-300 v1.00_B07 and earlier, AC-WAPU-300-P
v1.00_B ...)
- TODO: check
+ NOT-FOR-US: AC-WAPU-300
CVE-2023-28390 (Privilege escalation vulnerability in SR-7100VN firmware
Ver.1.38(N) a ...)
- TODO: check
+ NOT-FOR-US: SR-7100V
CVE-2023-28387
RESERVED
CVE-2023-28382
@@ -10218,19 +10218,19 @@ CVE-2023-28382
CVE-2023-28369 (Brother iPrint&Scan V6.11.2 and earlier contains an improper
access co ...)
NOT-FOR-US: Brother
CVE-2023-28367 (Cross-site scripting vulnerability in CTA post function of VK
All in O ...)
- TODO: check
+ NOT-FOR-US: VK All in One Expansion Unit
CVE-2023-27926 (Cross-site scripting vulnerability in Profile setting function
of VK A ...)
- TODO: check
+ NOT-FOR-US: VK All in One Expansion Unit
CVE-2023-27925 (Cross-site scripting vulnerability in Post function of VK
Blocks 1.53. ...)
- TODO: check
+ NOT-FOR-US: VK All in One Expansion Unit
CVE-2023-27923 (Cross-site scripting vulnerability in Tag edit function of VK
Blocks 1 ...)
- TODO: check
+ NOT-FOR-US: VK All in One Expansion Unit
CVE-2023-27922 (Cross-site scripting vulnerability in Newsletter versions
prior to 7.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-27921 (JINS MEME CORE Firmware version 2.2.0 and earlier uses a
hard-coded cr ...)
- TODO: check
+ NOT-FOR-US: JINS MEME
CVE-2023-27920 (Improper access control vulnerability in the system date/time
setting ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-27919 (Authentication bypass vulnerability in NEXT ENGINE Integration
Plugin ...)
NOT-FOR-US: NEXT ENGINE Integration Plugin
CVE-2023-27918 (Cross-site scripting vulnerability in Appointment and Event
Booking Ca ...)
@@ -10242,29 +10242,29 @@ CVE-2023-27888 (Cross-site scripting vulnerability in
Joruri Gw Ver 3.2.5 and ea
CVE-2023-27527 (Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts
XML extern ...)
NOT-FOR-US: Shinseiyo Sogo Soft
CVE-2023-27521 (OS command injection vulnerability in the mail setting page of
SolarVi ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-27518 (Buffer overflow vulnerability in the multiple setting pages of
SolarVi ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-27514 (OS command injection vulnerability in the download page of
SolarView C ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-27512 (Use of hard-coded credentials exists in SolarView Compact
SV-CPT-MC310 ...)
- TODO: check
+ NOT-FOR-US: SolarView
CVE-2023-27510 (JB Inquiry form contains an exposure of private personal
information t ...)
NOT-FOR-US: JB Inquiry form
CVE-2023-27507 (MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path
traversal ...)
- TODO: check
+ NOT-FOR-US: MicroEngine
CVE-2023-27397 (Unrestricted upload of file with dangerous type exists in
MicroEngine ...)
- TODO: check
+ NOT-FOR-US: MicroEngine
CVE-2023-27396
RESERVED
CVE-2023-27385 (Heap-based buffer overflow vulnerability exists in CX-Drive
All models ...)
NOT-FOR-US: CX-Drive All
CVE-2023-27384 (Operation restriction bypass vulnerability in MultiReport of
Cybozu Ga ...)
- TODO: check
+ NOT-FOR-US: Cybozu
CVE-2023-27304 (Operation restriction bypass vulnerability in Message and
Bulletin of ...)
- TODO: check
+ NOT-FOR-US: Cybozu
CVE-2023-26595 (Denial-of-service (DoS) vulnerability in Message of Cybozu
Garoon 4.10 ...)
- TODO: check
+ NOT-FOR-US: Cybozu
CVE-2023-26593 (CENTUM series provided by Yokogawa Electric Corporation are
vulnerable ...)
NOT-FOR-US: Yokogawa
CVE-2023-25955 (National land numerical information data conversion tool all
versions ...)
@@ -10272,7 +10272,7 @@ CVE-2023-25955 (National land numerical information
data conversion tool all ver
CVE-2023-25954 (KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA
MobilePrint' ...)
NOT-FOR-US: KYOCERA
CVE-2023-25953 (Code injection vulnerability in Drive Explorer for macOS
versions 3.5. ...)
- TODO: check
+ NOT-FOR-US: Drive Explorer for macOS
CVE-2023-25950 (HTTP request/response smuggling vulnerability in HAProxy
version 2.7.0 ...)
- haproxy 2.6.8-1
[bullseye] - haproxy <not-affected> (Vulnerable code not present)
@@ -10280,7 +10280,7 @@ CVE-2023-25950 (HTTP request/response smuggling
vulnerability in HAProxy version
NOTE:
https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46
(v2.7.1)
NOTE:
https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=22b44d5f2c7ce1ed0e4b62c639991d5abbd42a50
(v2.6.8)
CVE-2023-25946 (Authentication bypass vulnerability in Qrio Lock (Q-SL2)
firmware vers ...)
- TODO: check
+ NOT-FOR-US: Qrio Lock
CVE-2023-25755 (Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is
vulnerabl ...)
NOT-FOR-US: Screen Creator Advance
CVE-2023-25184 (Use of weak credentials exists in Seiko Solutions SkyBridge
and SkySpi ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7376c9e13257622c1da1b09cf2435b7d89f05f1b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7376c9e13257622c1da1b09cf2435b7d89f05f1b
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
