Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a876ec28 by Moritz Muehlenhoff at 2024-04-18T11:33:26+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,55 +3,55 @@ CVE-2024-3177
NOTE: Server components no longer built since 1.20.5+really1.20.2-1,
marking that as fixed version
NOTE: The source package itself it still vulnerable, but custom
rebuilds are not really a usecase here
CVE-2024-3932 (A vulnerability classified as problematic has been found in
Totara LMS ...)
- TODO: check
+ NOT-FOR-US: Totara LMS
CVE-2024-3931 (A vulnerability was found in Totara LMS 18.0.1 Build
20231128.01. It h ...)
- TODO: check
+ NOT-FOR-US: Totara LMS
CVE-2024-3928 (A vulnerability was found in Dromara open-capacity-platform
2.0.1. It ...)
- TODO: check
+ NOT-FOR-US: Dromara open-capacity-platform
CVE-2024-32746 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32745 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32744 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32743 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32472 (excalidraw is an open source virtual hand-drawn style
whiteboard. A st ...)
- TODO: check
+ NOT-FOR-US: excalidraw
CVE-2024-32345 (A cross-site scripting (XSS) vulnerability in the Settings
menu of CMS ...)
- TODO: check
+ NOT-FOR-US: CMSimple
CVE-2024-32344 (A cross-site scripting (XSS) vulnerability in the Settings
menu of CMS ...)
- TODO: check
+ NOT-FOR-US: CMSimple
CVE-2024-32343 (A cross-site scripting (XSS) vulnerability in the Create Page
of Boid ...)
- TODO: check
+ NOT-FOR-US: Boid CMS
CVE-2024-32342 (A cross-site scripting (XSS) vulnerability in the Create Page
of Boid ...)
- TODO: check
+ NOT-FOR-US: Boid CMS
CVE-2024-32341 (Multiple cross-site scripting (XSS) vulnerabilities in the
Home page o ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32340 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32339 (Multiple cross-site scripting (XSS) vulnerabilities in the HOW
TO page ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32338 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-32337 (A cross-site scripting (XSS) vulnerability in the Settings
section of ...)
- TODO: check
+ NOT-FOR-US: WonderCMS
CVE-2024-31869 (Airflow versions 2.7.0 through 2.8.4 have a vulnerability that
allows ...)
- TODO: check
+ - airflow <itp> (bug #819700)
CVE-2024-2729 (The Otter Blocks WordPress plugin before 2.6.6 does not
properly esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-29956 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a
prints the ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2024-29955 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a
could allo ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2024-29952 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a
could allo ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2024-1429 (The Element Pack Elementor Addons (Header Footer, Free Template
Librar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-1426 (The Element Pack Elementor Addons (Header Footer, Free Template
Librar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-4509 (It is possible for an API key to be logged in clear text in the
audit ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2023-4235 (A flaw was found in ofono, an Open Source Telephony on Linux. A
stack ...)
TODO: check
CVE-2023-4234 (A flaw was found in ofono, an Open Source Telephony on Linux. A
stack ...)
@@ -79,7 +79,7 @@ CVE-2024-3905 (A vulnerability was found in Tenda AC500
2.0.1.9(1307). It has be
CVE-2024-3900 (Out-of-bounds array write in Xpdf 4.05 and earlier, triggered
by long ...)
TODO: check
CVE-2024-3825 (Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain
a flaw ...)
- TODO: check
+ NOT-FOR-US: Jenkins plugin
CVE-2024-3817 (HashiCorp\u2019s go-getter library is vulnerable to argument
injection ...)
- golang-github-hashicorp-go-getter <unfixed>
NOTE:
https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040
@@ -262,15 +262,15 @@ CVE-2024-30951 (FUDforum v3.1.3 was discovered to contain
a reflected cross-site
CVE-2024-30950 (A stored cross-site scripting (XSS) vulnerability in FUDforum
v3.1.3 a ...)
NOT-FOR-US: FUDforum
CVE-2024-30253 (@solana/web3.js is the Solana JavaScript SDK. Using particular
inputs ...)
- TODO: check
+ NOT-FOR-US: @solana/web3.js
CVE-2024-2419 (A flaw was found in Keycloak's redirect_uri validation logic.
This iss ...)
NOT-FOR-US: Keycloak
CVE-2024-29951 (Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash
in intern ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2024-29950 (The class FileTransfer implemented in Brocade SANnav before
v2.3.1, v2 ...)
- TODO: check
+ NOT-FOR-US: Brocade
CVE-2024-29035 (Umbraco is an ASP.NET CMS. Failing webhooks logs are available
when so ...)
- TODO: check
+ NOT-FOR-US: Umbraco
CVE-2024-28073 (SolarWinds Serv-U was found to be susceptible to a Directory
Traversal ...)
NOT-FOR-US: SolarWinds
CVE-2024-24856 (The memory allocation function ACPI_ALLOCATE_ZEROED does not
guarantee ...)
@@ -280,57 +280,57 @@ CVE-2024-21990 (ONTAP Select Deploy administration
utility versions 9.12.1.x, 9
CVE-2024-21989 (ONTAP Select Deploy administration utility versions 9.12.1.x,
9.13.1. ...)
NOT-FOR-US: ONTAP / NetAPP
CVE-2024-1350 (Missing Authorization vulnerability in Prasidhda Malla Honeypot
for WP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-1249 (A flaw was found in Keycloak's OIDC component in the
"checkLoginIframe ...)
NOT-FOR-US: Keycloak
CVE-2024-1132 (A flaw was found in Keycloak, where it does not properly
validate URLs ...)
NOT-FOR-US: Keycloak
CVE-2024-0257 (RoboDK v5.5.4 is vulnerable to heap-based buffer overflow
while proc ...)
- TODO: check
+ NOT-FOR-US: RoboDK
CVE-2023-6805 (The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging,
News & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5407 (Controller denial of service due to improper handling of a
specially c ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5406 (Server communication with a controller can lead to remote code
executi ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5405 (Server information leak for the CDA Server process memory can
occur wh ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5404 (Server receiving a malformed message can cause a pointer to be
overwri ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5403 (Server hostname translation to IP address manipulation which
could lea ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5401 (Server receiving a malformed message based on a using the
specified ke ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5400 (Server receiving a malformed message based on a using the
specified ke ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5398 (Server receiving a malformed message based on a list of IPs
resulting ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5397 (Server receiving a malformed message to create a new connection
could ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5396 (Server receiving a malformed message creates connection for a
hostname ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-5395 (Server receiving a malformed message that uses the hostname in
an inte ...)
- TODO: check
+ NOT-FOR-US: Honeywell
CVE-2023-51500 (Missing Authorization vulnerability in Undsgn Uncode Core.This
issue a ...)
- TODO: check
+ NOT-FOR-US: Undsgn Uncode Core
CVE-2023-51418 (Missing Authorization vulnerability in Joris van Montfort JVM
rich tex ...)
- TODO: check
+ NOT-FOR-US: Joris van Montfort JVM rich text icons
CVE-2023-46060 (A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9
allows a remo ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2023-45744 (A data integrity vulnerability exists in the web interface
/cgi-bin/up ...)
- TODO: check
+ NOT-FOR-US: Peplink Smart Reader
CVE-2023-45209 (An information disclosure vulnerability exists in the web
interface /c ...)
- TODO: check
+ NOT-FOR-US: Peplink Smart Reader
CVE-2023-44227 (Missing Authorization vulnerability in Mitchell Bennis Simple
File Lis ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-43491 (An information disclosure vulnerability exists in the web
interface /c ...)
- TODO: check
+ NOT-FOR-US: Peplink Smart Reader
CVE-2023-40146 (A privilege escalation vulnerability exists in the /bin/login
function ...)
- TODO: check
+ NOT-FOR-US: Peplink Smart Reader
CVE-2023-39367 (An OS command injection vulnerability exists in the web
interface mac2 ...)
- TODO: check
+ NOT-FOR-US: Peplink Smart Reader
CVE-2023-36505 (Improper Input Validation vulnerability in Saturday Drive
Ninja Forms ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-2961 (The iconv() function in the GNU C Library versions 2.39 and
older may ...)
- glibc <unfixed> (bug #1069191)
NOTE: https://www.openwall.com/lists/oss-security/2024/04/17/9
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a876ec281abc3d9d201e69e7e15cd35f4ff22b44
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a876ec281abc3d9d201e69e7e15cd35f4ff22b44
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
