Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c50697f4 by Salvatore Bonaccorso at 2023-10-19T22:26:13+02:00
Process some more NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,91 +1,91 @@
CVE-2023-5654 (The React Developer Tools extension registers a message
listener with ...)
- TODO: check
+ NOT-FOR-US: React Developer Tools extension
CVE-2023-5059 (Santesoft Sante FFT Imaging lacks proper validation of
user-supplied d ...)
- TODO: check
+ NOT-FOR-US: Santesoft Sante FFT Imaging
CVE-2023-46227 (Deserialization of Untrusted Data Vulnerability in Apache
Software Fou ...)
- TODO: check
+ NOT-FOR-US: Apache InLong
CVE-2023-46042 (An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to
execute ...)
- TODO: check
+ NOT-FOR-US: GetSimpleCMS
CVE-2023-46033 (D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U
N150 ADSL ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2023-45992 (Cross Site Scripting vulnerability in Ruckus Wireless
(CommScope) Ruck ...)
- TODO: check
+ NOT-FOR-US: Ruckus
CVE-2023-45883 (A privilege escalation vulnerability exists within the Qumu
Multicast ...)
- TODO: check
+ NOT-FOR-US: Qumu Multicast Extension
CVE-2023-45826 (Leantime is an open source project management system. A
'userId' varia ...)
- TODO: check
+ NOT-FOR-US: Leantime
CVE-2023-45825 (ydb-go-sdk is a pure Go native and database/sql driver for the
YDB pla ...)
TODO: check
CVE-2023-45820 (Directus is a real-time API and App dashboard for managing SQL
databas ...)
- TODO: check
+ NOT-FOR-US: Directus
CVE-2023-45809 (Wagtail is an open source content management system built on
Django. A ...)
- TODO: check
+ NOT-FOR-US: Wagtail
CVE-2023-45665
REJECTED
CVE-2023-45384 (KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to
Unrestrict ...)
- TODO: check
+ NOT-FOR-US: KnowBand supercheckout
CVE-2023-45381 (In the module "Creative Popup" (creativepopup) up to version
1.6.9 fro ...)
- TODO: check
+ NOT-FOR-US: PrestaShop module
CVE-2023-45379 (In the module "Rotator Img" (posrotatorimg) in versions at
least up to ...)
- TODO: check
+ NOT-FOR-US: PosThemes for PrestaShop
CVE-2023-45376 (In the module "Carousels Pack - Instagram, Products, Brands,
Supplier" ...)
- TODO: check
+ NOT-FOR-US: PrestaShop module
CVE-2023-45281 (An issue in Yamcs 5.8.6 allows attackers to obtain the session
cookie ...)
- TODO: check
+ NOT-FOR-US: Yamcs
CVE-2023-45278 (Directory Traversal vulnerability in the storage functionality
of the ...)
- TODO: check
+ NOT-FOR-US: Yamcs
CVE-2023-45277 (Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of
2). The v ...)
- TODO: check
+ NOT-FOR-US: Yamcs
CVE-2023-43986 (DM Concept configurator before v4.9.4 was discovered to
contain a SQL ...)
- TODO: check
+ NOT-FOR-US: DM Concept configurator (PrestaShop module)
CVE-2023-43492 (In Weintek's cMT3000 HMI Web CGI device, the cgi-bin
codesys.cgi conta ...)
- TODO: check
+ NOT-FOR-US: Weintek's cMT3000 HMI Web CGI device
CVE-2023-43252 (XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a
crafted i ...)
- TODO: check
+ NOT-FOR-US: XNSoft Nconvert
CVE-2023-43251 (XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted
via a c ...)
- TODO: check
+ NOT-FOR-US: XNSoft Nconvert
CVE-2023-42666 (The affected product is vulnerable to an exposure of sensitive
informa ...)
- TODO: check
+ NOT-FOR-US: DEXMA
CVE-2023-42435 (The affected product is vulnerable to a cross-site request
forgery vul ...)
- TODO: check
+ NOT-FOR-US: DEXMA
CVE-2023-41089 (The affected product is vulnerable to an improper
authentication vulne ...)
- TODO: check
+ NOT-FOR-US: DEXMA
CVE-2023-41088 (The affected product is vulnerable to a cleartext transmission
of sens ...)
- TODO: check
+ NOT-FOR-US: DEXMA
CVE-2023-40153 (The affected product is vulnerable to a cross-site scripting
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: DEXMA
CVE-2023-40145 (In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker
can exe ...)
- TODO: check
+ NOT-FOR-US: Weintek's cMT3000 HMI Web CGI device
CVE-2023-39431 (Sante DICOM Viewer Pro lacks proper validation of
user-supplied data w ...)
- TODO: check
+ NOT-FOR-US: Sante DICOM Viewer Pro
CVE-2023-38584 (In Weintek's cMT3000 HMI Web CGI device, the cgi-bin
command_wb.cgi co ...)
- TODO: check
+ NOT-FOR-US: Weintek's cMT3000 HMI Web CGI device
CVE-2023-38128 (An out-of-bounds write vulnerability exists in the
"HyperLinkFrame" st ...)
- TODO: check
+ NOT-FOR-US: Ichitaro
CVE-2023-38127 (An integer overflow exists in the "HyperLinkFrame" stream
parser of Ic ...)
- TODO: check
+ NOT-FOR-US: Ichitaro
CVE-2023-35986 (Sante DICOM Viewer Pro lacks proper validation of
user-supplied data w ...)
- TODO: check
+ NOT-FOR-US: Sante DICOM Viewer Pro
CVE-2023-35187 (The SolarWinds Access Rights Manager was susceptible to a
Directory Tr ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35186 (The SolarWinds Access Rights Manager was susceptible to Remote
Code Ex ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35185 (The SolarWinds Access Rights Manager was susceptible to a
Directory Tr ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35184 (The SolarWinds Access Rights Manager was susceptible to Remote
Code Ex ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35183 (The SolarWinds Access Rights Manager was susceptible to
Privilege Esca ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35182 (The SolarWinds Access Rights Manager was susceptible to Remote
Code Ex ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35181 (The SolarWinds Access Rights Manager was susceptible to
Privilege Esca ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35180 (The SolarWinds Access Rights Manager was susceptible to Remote
Code Ex ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2023-35126 (An out-of-bounds write vulnerability exists within the parsers
for bot ...)
- TODO: check
+ NOT-FOR-US: Ichitaro
CVE-2023-34366 (A use-after-free vulnerability exists in the Figure stream
parsing fun ...)
- TODO: check
+ NOT-FOR-US: Ichitaro
CVE-2023-45024
- request-tracker5 <unfixed>
NOTE: https://github.com/bestpractical/rt/releases/tag/rt-5.0.5
@@ -126,13 +126,13 @@ CVE-2023-45958 (Thirty Bees Core v1.4.0 was discovered to
contain a reflected cr
CVE-2023-45909 (zzzcms v2.2.0 was discovered to contain an open redirect
vulnerability ...)
NOT-FOR-US: zzzcms
CVE-2023-45814 (Bunkum is an open-source protocol-agnostic request server for
custom g ...)
- TODO: check
+ NOT-FOR-US: Bunkum
CVE-2023-45813 (Torbot is an open source tor network intelligence tool. In
affected ve ...)
- TODO: check
+ NOT-FOR-US: Torbot
CVE-2023-45812 (The Apollo Router is a configurable, high-performance graph
router wri ...)
TODO: check
CVE-2023-45146 (XXL-RPC is a high performance, distributed RPC framework. With
it, a T ...)
- TODO: check
+ NOT-FOR-US: XXL-RPC
CVE-2023-45145 (Redis is an in-memory database that persists on disk. On
startup, Redi ...)
- redis 5:7.0.14-1 (bug #1054225)
NOTE:
https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
@@ -232,7 +232,7 @@ CVE-2023-45056 (Auth. (admin+) Stored Cross-Site Scripting
(XSS) vulnerability i
CVE-2023-45054 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
AWESOME ...)
NOT-FOR-US: WordPress plugin
CVE-2023-43250 (XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There
is a Use ...)
- TODO: check
+ NOT-FOR-US: XNSoft Nconvert
CVE-2023-35663 (In Init of protocolnetadapter.cpp, there is a possible out of
bounds r ...)
NOT-FOR-US: Android
CVE-2023-35656 (In multiple functions of protocolembmsadapter.cpp, there is a
possible ...)
@@ -22503,7 +22503,7 @@ CVE-2023-31047 (In Django 3.2 before 3.2.19, 4.x before
4.1.9, and 4.2 before 4.
NOTE:
https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
(3.2.19)
NOTE: https://www.openwall.com/lists/oss-security/2023/05/03/1
CVE-2023-31046 (A Path Traversal vulnerability exists in PaperCut NG before
22.1.1 and ...)
- TODO: check
+ NOT-FOR-US: PaperCut
CVE-2023-31045 (A stored Cross-site scripting (XSS) issue in Text Editors and
Formats ...)
- backdrop <itp> (bug #914257)
CVE-2023-31044
@@ -23798,7 +23798,7 @@ CVE-2023-30635 (TiKV 6.1.2 allows remote attackers to
cause a denial of service
CVE-2023-30634
RESERVED
CVE-2023-30633 (An issue was discovered in TrEEConfigDriver in Insyde
InsydeH2O with k ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2023-30632
RESERVED
CVE-2023-30631 (Improper Input Validation vulnerability in Apache Software
Foundation ...)
@@ -33095,7 +33095,7 @@ CVE-2023-27793
CVE-2023-27792
RESERVED
CVE-2023-27791 (An issue found in IXP Data Easy Install 6.6.148840 allows a
remote att ...)
- TODO: check
+ NOT-FOR-US: IXP Data Easy Install
CVE-2023-27790
RESERVED
CVE-2023-27789 (An issue found in TCPprep v.4.4.3 allows a remote attacker to
cause a ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c50697f440800122bae808d52615f451ff327a2e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c50697f440800122bae808d52615f451ff327a2e
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
