Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
38f746a7 by Salvatore Bonaccorso at 2023-12-25T09:26:32+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,77 +1,77 @@
CVE-2023-7102 (Use of a Third Party library produced a vulnerability in
Barracuda Net ...)
- TODO: check
+ NOT-FOR-US: Barracuda (its use of Spreadsheet::ParseExcel, cf.
CVE-2023-7102)
CVE-2023-7101 (Spreadsheet::ParseExcel version 0.65 is a Perl module used for
parsing ...)
- libspreadsheet-parseexcel-perl <unfixed>
NOTE:
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
NOTE: https://github.com/haile01/perl_spreadsheet_excel_rce_poc
CVE-2023-7100 (A vulnerability, which was classified as critical, was found in
PHPGur ...)
- TODO: check
+ NOT-FOR-US: PHPGurukul Restaurant Table Booking System
CVE-2023-7099 (A vulnerability, which was classified as critical, has been
found in P ...)
- TODO: check
+ NOT-FOR-US: PHPGurukul Nipah Virus Testing Management System
CVE-2023-7098 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as
problema ...)
- TODO: check
+ NOT-FOR-US: icret EasyImages
CVE-2023-7097 (A vulnerability classified as critical has been found in
code-projects ...)
- TODO: check
+ NOT-FOR-US: code-projects Water Billing System
CVE-2023-7096 (A vulnerability was found in code-projects Faculty Management
System 1 ...)
- TODO: check
+ NOT-FOR-US: code-projects Faculty Management System
CVE-2023-7095 (A vulnerability, which was classified as critical, has been
found in T ...)
- TODO: check
+ NOT-FOR-US: Totolink
CVE-2023-7094 (A vulnerability classified as problematic was found in
Netentsec NS-AS ...)
- TODO: check
+ NOT-FOR-US: Netentsec NS-ASG Application Security Gateway
CVE-2023-7093 (A vulnerability classified as critical has been found in
KylinSoft kyl ...)
- TODO: check
+ NOT-FOR-US: KylinSoft kylin-system-updater
CVE-2023-7092 (A vulnerability was found in Uniway UW-302VP 2.0. It has been
rated as ...)
- TODO: check
+ NOT-FOR-US: Uniway UW-302VP
CVE-2023-7091 (A vulnerability was found in Dreamer CMS 4.1.3. It has been
declared a ...)
- TODO: check
+ NOT-FOR-US: Dreamer CMS
CVE-2023-51772 (One Identity Password Manager before 5.13.1 allows Kiosk
Escape. This ...)
- TODO: check
+ NOT-FOR-US: One Identity Password Manager
CVE-2023-51771 (In MicroHttpServer (aka Micro HTTP Server) through a8ab029,
_ParseHead ...)
- TODO: check
+ NOT-FOR-US: MicroHttpServer
CVE-2023-51714 (An issue was discovered in the HTTP2 implementation in Qt
before 5.15. ...)
TODO: check
CVE-2023-49954 (The CRM Integration in 3CX before 18.0.9.23 and 20 before
20.0.0.1494 ...)
- TODO: check
+ NOT-FOR-US: 3CX
CVE-2023-49944 (The Challenge Response feature of BeyondTrust Privilege
Management for ...)
- TODO: check
+ NOT-FOR-US: BeyondTrust
CVE-2023-49880 (In the Message Entry and Repair (MER) facility of IBM
Financial Transa ...)
NOT-FOR-US: IBM
CVE-2023-49328 (On a Wolters Kluwer B.POINT 23.70.00 server running Linux on
premises, ...)
- TODO: check
+ NOT-FOR-US: Wolters Kluwer B.POINT
CVE-2023-49226 (An issue was discovered in Peplink Balance Two before 8.4.0.
Command i ...)
- TODO: check
+ NOT-FOR-US: Peplink Balance Two
CVE-2023-48654 (One Identity Password Manager before 5.13.1 allows Kiosk
Escape. This ...)
- TODO: check
+ NOT-FOR-US: One Identity Password Manager
CVE-2023-48652 (Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site
Request Forger ...)
- TODO: check
+ NOT-FOR-US: Concrete CMS
CVE-2023-47247 (In SysAid On-Premise before 23.3.34, there is an edge case in
which an ...)
- TODO: check
+ NOT-FOR-US: SysAid
CVE-2023-47091 (An issue was discovered in Stormshield Network Security (SNS)
SNS 4.3. ...)
- TODO: check
+ NOT-FOR-US: Stormshield Network Security (SNS) SNS
CVE-2023-43064 (Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow
a local ...)
NOT-FOR-US: IBM
CVE-2023-40236 (In Pexip VMR self-service portal before 3, the same SSH host
key is us ...)
- TODO: check
+ NOT-FOR-US: Pexip
CVE-2023-38826 (A Cross Site Scripting (XSS) vulnerability exists in Follet
Learning S ...)
- TODO: check
+ NOT-FOR-US: Follet Learning Solutions Destiny
CVE-2023-37225 (Pexip Infinity before 32 allows Webapp1 XSS via preconfigured
links.)
- TODO: check
+ NOT-FOR-US: Pexip
CVE-2023-37188 (C-blosc2 before 2.9.3 was discovered to contain a NULL pointer
derefer ...)
- TODO: check
+ NOT-FOR-US: C-blosc2
CVE-2023-37187 (C-blosc2 before 2.9.3 was discovered to contain a NULL pointer
derefer ...)
- TODO: check
+ NOT-FOR-US: C-blosc2
CVE-2023-37186 (C-blosc2 before 2.9.3 was discovered to contain a NULL pointer
derefer ...)
- TODO: check
+ NOT-FOR-US: C-blosc2
CVE-2023-37185 (C-blosc2 before 2.9.3 was discovered to contain a NULL pointer
derefer ...)
- TODO: check
+ NOT-FOR-US: C-blosc2
CVE-2023-36486 (The workflow-engine of ILIAS before 7.23 and 8 before 8.3
allows remot ...)
- TODO: check
+ NOT-FOR-US: ILIAS
CVE-2023-36485 (The workflow-engine of ILIAS before 7.23 and 8 before 8.3
allows remot ...)
- TODO: check
+ NOT-FOR-US: ILIAS
CVE-2023-31455 (Pexip Infinity before 31.2 has Improper Input Validation for
RTCP, all ...)
- TODO: check
+ NOT-FOR-US: Pexip
CVE-2023-31297 (An issue was discovered in SESAMI planfocus CPTO (Cash Point &
Transpo ...)
- TODO: check
+ NOT-FOR-US: SESAMI planfocus CPTO (Cash Point & Transport Optimizer)
CVE-2023-51767 (OpenSSH through 9.6, when common types of DRAM are used, might
allow r ...)
- openssh <unfixed> (bug #1059393)
[bookworm] - openssh <postponed> (Revisit once hardening/mitigation for
Rowhammer type of attack exists)
@@ -34022,7 +34022,7 @@ CVE-2023-31436 (qfq_change_class in net/sched/sch_qfq.c
in the Linux kernel befo
CVE-2023-31290 (Trust Wallet Core before 3.1.1, as used in the Trust Wallet
browser ex ...)
NOT-FOR-US: Trust Wallet Core
CVE-2023-31289 (Pexip Infinity before 31.2 has Improper Input Validation for
signallin ...)
- TODO: check
+ NOT-FOR-US: Pexip
CVE-2023-31288
RESERVED
CVE-2023-31287 (An issue was discovered in Serenity Serene (and StartSharp)
before 6.7 ...)
@@ -34211,7 +34211,7 @@ CVE-2021-46882 (The video framework has memory
overwriting caused by addition ov
CVE-2021-46881 (The video framework has memory overwriting caused by addition
overflow ...)
NOT-FOR-US: Huawei
CVE-2023-31224 (There is broken access control during authentication in Jamf
Pro Serve ...)
- TODO: check
+ NOT-FOR-US: Jamf Pro
CVE-2023-31223 (Dradis before 4.8.0 allows persistent XSS by authenticated
author user ...)
NOT-FOR-US: Dradis
CVE-2023-2295 (A vulnerability was found in the libreswan library. This
security issu ...)
@@ -41409,7 +41409,7 @@ CVE-2023-28874 (The next parameter in the
/accounts/login endpoint of Seafile 9.
CVE-2023-28873 (An XSS issue in wiki and discussion pages in Seafile 9.0.6
allows atta ...)
- seafile-server <itp> (bug #865830)
CVE-2023-28872 (Support Assistant in NCP Secure Enterprise Client before 13.10
allows ...)
- TODO: check
+ NOT-FOR-US: Support Assistant in NCP Secure Enterprise Client
CVE-2023-28871 (Support Assistant in NCP Secure Enterprise Client before 12.22
allows ...)
NOT-FOR-US: Support Assistant in NCP Secure Enterprise Client
CVE-2023-28870 (Insecure File Permissions in Support Assistant in NCP Secure
Enterpris ...)
@@ -79735,7 +79735,7 @@ CVE-2022-43677 (In free5GC 3.2.1, a malformed NGAP
message can crash the AMF and
CVE-2022-43676
RESERVED
CVE-2022-43675 (An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in
the Net ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-43674
RESERVED
CVE-2022-43673 (Wire through 3.22.3993 on Windows advertises deletion of sent
messages ...)
@@ -85314,11 +85314,11 @@ CVE-2022-41764
CVE-2022-41763 (An issue was discovered in NOKIA AMS 9.7.05. Remote Code
Execution exi ...)
NOT-FOR-US: NOKIA AMS
CVE-2022-41762 (An issue was discovered in NOKIA NFM-T R19.9. Multiple
Reflected XSS v ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-41761 (An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path
Travers ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-41760 (An issue was discovered in NOKIA NFM-T R19.9. Relative Path
Traversal ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-41759
RESERVED
CVE-2022-41758
@@ -90310,15 +90310,15 @@ CVE-2022-39824 (Server-side JavaScript injection in
Appsmith through 1.7.14 allo
CVE-2022-39823 (An issue was discovered in Softing OPC UA C++ SDK 5.66 through
6.x bef ...)
NOT-FOR-US: Softing
CVE-2022-39822 (In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in
/cgi-bin ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-39821 (In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information
into an ...)
NOT-FOR-US: NOKIA
CVE-2022-39820 (In Network Element Manager in NOKIA NFM-T R19.9, an
Unprotected Storag ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-39819 (In NOKIA 1350 OMS R14.2, multiple OS Command Injection
vulnerabilities ...)
NOT-FOR-US: NOKIA
CVE-2022-39818 (In NOKIA NFM-T R19.9, an OS Command Injection vulnerability
occurs in ...)
- TODO: check
+ NOT-FOR-US: NOKIA
CVE-2022-39817 (In NOKIA 1350 OMS R14.2, multiple SQL Injection
vulnerabilities occurs ...)
NOT-FOR-US: NOKIA
CVE-2022-39816 (In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials
(clearte ...)
@@ -105958,9 +105958,9 @@ CVE-2022-34270
CVE-2022-34269
RESERVED
CVE-2022-34268 (An issue was discovered in RWS WorldServer before 11.7.3.
/clientLogin ...)
- TODO: check
+ NOT-FOR-US: RWS WorldServer
CVE-2022-34267 (An issue was discovered in RWS WorldServer before 11.7.3.
Adding a tok ...)
- TODO: check
+ NOT-FOR-US: RWS WorldServer
CVE-2022-34266 (The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon
Linux 2 a ...)
NOT-FOR-US: libtiff-4.0.3-35.amzn2.0.1 Amazon package
CVE-2022-34265 (An issue was discovered in Django 3.2 before 3.2.14 and 4.0
before 4.0 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38f746a775af8398cbef874c4ba32b2ab352e2c6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38f746a775af8398cbef874c4ba32b2ab352e2c6
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
