Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
84bb25df by security tracker role at 2024-01-04T20:12:05+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,59 @@
+CVE-2024-21625 (SideQuest is a place to get virtual reality applications for
Oculus Qu ...)
+ TODO: check
+CVE-2023-7044 (The Essential Addons for Elementor \u2013 Best Elementor
Templates, Wi ...)
+ TODO: check
+CVE-2023-6992 (Cloudflare version of zlib library was found to be vulnerable
to memor ...)
+ TODO: check
+CVE-2023-6551 (As a simple library, class.upload.php does not perform an
in-depth che ...)
+ TODO: check
+CVE-2023-6270 (A flaw was found in the ATA over Ethernet (AoE) driver in the
Linux ke ...)
+ TODO: check
+CVE-2023-5619
+ REJECTED
+CVE-2023-5442
+ REJECTED
+CVE-2023-51812 (Tenda AX3 v16.03.12.11 was discovered to contain a remote code
executi ...)
+ TODO: check
+CVE-2023-51154 (Jizhicms v2.5 was discovered to contain an arbitrary file
download vul ...)
+ TODO: check
+CVE-2023-50867 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50866 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50865 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50864 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50863 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50862 (Travel Website v1.0 is vulnerable to multiple Unauthenticated
SQL Inje ...)
+ TODO: check
+CVE-2023-50760 (Online Notice Board System v1.0 is vulnerable to an Insecure
File Uplo ...)
+ TODO: check
+CVE-2023-50753 (Online Notice Board System v1.0 is vulnerable to multiple
Unauthentica ...)
+ TODO: check
+CVE-2023-50752 (Online Notice Board System v1.0 is vulnerable to multiple
Unauthentica ...)
+ TODO: check
+CVE-2023-50743 (Online Notice Board System v1.0 is vulnerable to multiple
Unauthentica ...)
+ TODO: check
+CVE-2023-49666 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49665 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49658 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49639 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49633 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49625 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49624 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-49622 (Billing Software v1.0 is vulnerable to multiple
Unauthenticated SQL In ...)
+ TODO: check
+CVE-2023-3726 (OCSInventory allow stored email template with special
characters that ...)
+ TODO: check
CVE-2024-21634 (Amazon Ion is a Java implementation of the Ion data notation.
Prior to ...)
NOT-FOR-US: Amazon Ion
CVE-2024-20809 (Improper access control vulnerability in Nearby device
scanning prior ...)
@@ -43,15 +99,19 @@ CVE-2023-49442 (Deserialization of Untrusted Data in
jeecgFormDemoController in
CVE-2023-41784 (Permissions and Access Control Vulnerability in ZTE Red Magic
8 Pro)
NOT-FOR-US: ZTE
CVE-2024-0225 (Use after free in WebGPU in Google Chrome prior to
120.0.6099.199 allo ...)
+ {DSA-5595-1}
- chromium 120.0.6099.199-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-0224 (Use after free in WebAudio in Google Chrome prior to
120.0.6099.199 al ...)
+ {DSA-5595-1}
- chromium 120.0.6099.199-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-0223 (Heap buffer overflow in ANGLE in Google Chrome prior to
120.0.6099.199 ...)
+ {DSA-5595-1}
- chromium 120.0.6099.199-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-0222 (Use after free in ANGLE in Google Chrome prior to
120.0.6099.199 allow ...)
+ {DSA-5595-1}
- chromium 120.0.6099.199-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-21911 (TinyMCE versions before 5.6.0 are affected by a stored
cross-site scri ...)
@@ -525,7 +585,7 @@ CVE-2023-7130 (A vulnerability has been found in
code-projects College Notes Gal
NOT-FOR-US: code-projects College Notes Gallery
CVE-2023-6094 (A vulnerability has been identified in OnCell G3150A-LTE Series
firmwa ...)
NOT-FOR-US: OnCell G3150A-LTE Series firmware
-CVE-2023-6093 (A vulnerability has been identified in OnCell G3150A-LTE Series
firmwa ...)
+CVE-2023-6093 (A clickjacking vulnerability has been identified in OnCell
G3150A-LTE ...)
NOT-FOR-US: OnCell G3150A-LTE Series firmware
CVE-2023-52185 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
NOT-FOR-US: WordPress plugin
@@ -1222,7 +1282,7 @@ CVE-2014-125109 (A vulnerability was found in BestWebSoft
Portfolio Plugin up to
NOT-FOR-US: WordPress plugin
CVE-2012-10017 (A vulnerability was found in BestWebSoft Portfolio Plugin up
to 2.04 o ...)
NOT-FOR-US: WordPress plugin
-CVE-2023-51467 (The vulnerability allows attackers to bypass authentication to
achieve ...)
+CVE-2023-51467 (The vulnerability permits attackers to circumvent
authentication proce ...)
NOT-FOR-US: Apache OFBiz
CVE-2023-50968 (Arbitrary file properties reading vulnerability in Apache
Software Fou ...)
NOT-FOR-US: Apache OFBiz
@@ -2288,7 +2348,7 @@ CVE-2023-35883 (URL Redirection to Untrusted Site ('Open
Redirect') vulnerabilit
NOT-FOR-US: WordPress plugin
CVE-2023-6945 (A vulnerability has been found in SourceCodester Online Student
Manage ...)
NOT-FOR-US: SourceCodester Online Student Management System
-CVE-2023-6944
+CVE-2023-6944 (A flaw was found in the Red Hat Developer Hub (RHDH). The
catalog-impo ...)
NOT-FOR-US: Red Hat Developer Hub (RHDH)
CVE-2023-6932 (A use-after-free vulnerability in the Linux kernel's ipv4: igmp
compon ...)
{DSA-5594-1}
@@ -32337,7 +32397,7 @@ CVE-2023-33958 (notation is a CLI tool to sign and
verify OCI artifacts and cont
NOT-FOR-US: notation
CVE-2023-33957 (notation is a CLI tool to sign and verify OCI artifacts and
container ...)
NOT-FOR-US: notation
-CVE-2023-33952 (A double-free vulnerability was found in the vmwgfx driver in
the Linu ...)
+CVE-2023-33952 (A double-free vulnerability was found in handling
vmw_buffer_object ob ...)
- linux 6.1.15-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
@@ -75627,8 +75687,8 @@ CVE-2022-3866 (HashiCorp Nomad and Nomad Enterprise
1.4.0 up to 1.4.1 workload i
NOTE:
https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167
CVE-2022-3865 (The WP User Merger WordPress plugin before 1.5.3 does not
properly san ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-3864
- RESERVED
+CVE-2022-3864 (A vulnerability exists in the Relion update package signature
validati ...)
+ TODO: check
CVE-2022-3863 (Use after free in Browser History in Google Chrome prior to
100.0.4896 ...)
{DSA-5114-1}
- chromium 100.0.4896.75-1
@@ -110114,8 +110174,8 @@ CVE-2022-28127 (A data removal vulnerability exists
in the web_server /action/re
NOT-FOR-US: Robustel R1510
CVE-2022-2082
RESERVED
-CVE-2022-2081
- RESERVED
+CVE-2022-2081 (A vulnerability exists in the HCI Modbus TCP function included
in the ...)
+ TODO: check
CVE-2022-2080 (The Sensei LMS WordPress plugin before 4.5.2 does not ensure
that the ...)
NOT-FOR-US: WordPress plugin
CVE-2022-2079 (Cross-site Scripting (XSS) - Stored in GitHub repository
nocodb/nocodb ...)
@@ -146145,8 +146205,8 @@ CVE-2021-45467 (In CWP (aka Control Web Panel or
CentOS Web Panel) before 0.9.8.
NOT-FOR-US: CentOS Web Panel
CVE-2021-45466 (In CWP (aka Control Web Panel or CentOS Web Panel) before
0.9.8.1107, ...)
NOT-FOR-US: CentOS Web Panel
-CVE-2021-45465
- RESERVED
+CVE-2021-45465 (A vulnerability has been identified in syngo fastView (All
versions). ...)
+ TODO: check
CVE-2021-4160 (There is a carry propagation bug in the MIPS32 and MIPS64
squaring pro ...)
{DSA-5103-1}
- openssl 1.1.1m-1
@@ -160536,8 +160596,8 @@ CVE-2021-42030
RESERVED
CVE-2021-42029 (A vulnerability has been identified in SIMATIC STEP 7 (TIA
Portal) V15 ...)
NOT-FOR-US: Siemens
-CVE-2021-42028
- RESERVED
+CVE-2021-42028 (A vulnerability has been identified in syngo fastView (All
versions). ...)
+ TODO: check
CVE-2021-42027 (A vulnerability has been identified in SINUMERIK Edge (All
versions < ...)
NOT-FOR-US: Siemens
CVE-2021-42026 (A vulnerability has been identified in Mendix Applications
using Mendi ...)
@@ -164887,8 +164947,8 @@ CVE-2021-40369 (A carefully crafted plugin link
invocation could trigger an XSS
- jspwiki <removed>
CVE-2021-40368 (A vulnerability has been identified in SIMATIC S7-400 CPU
412-1 DP V7 ...)
NOT-FOR-US: Siemens
-CVE-2021-40367
- RESERVED
+CVE-2021-40367 (A vulnerability has been identified in syngo fastView (All
versions). ...)
+ TODO: check
CVE-2021-40366 (A vulnerability has been identified in Climatix POL909 (AWB
module) (A ...)
NOT-FOR-US: Siemens
CVE-2021-40365 (Affected devices don't process correctly certain special
crafted packe ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/84bb25dfbf250e263ca193350a3ffdde47d7ac9d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/84bb25dfbf250e263ca193350a3ffdde47d7ac9d
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
