Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
91d73b3b by Moritz Muehlenhoff at 2024-06-05T09:55:14+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -14,15 +14,15 @@ CVE-2024-4520 (An improper access control vulnerability
exists in the gaizhenbia
CVE-2024-4254 (The 'deploy-website.yml' workflow in the gradio-app/gradio
repository, ...)
NOT-FOR-US: Gradio
CVE-2024-37273 (An arbitrary file upload vulnerability in the
/v1/app/appendFileSync i ...)
- TODO: check
+ NOT-FOR-US: Jan
CVE-2024-37065 (Deserialization of untrusted data can occur in versions 0.6 or
newer o ...)
- TODO: check
+ NOT-FOR-US: Skops
CVE-2024-37064 (Deseriliazation of untrusted data can occur in versions 3.7.0
or newer ...)
- TODO: check
+ NOT-FOR-US: ydata-profiling
CVE-2024-37063 (A cross-site scripting (XSS) vulnerability in versions 3.7.0
or newer ...)
- TODO: check
+ NOT-FOR-US: ydata-profiling
CVE-2024-37062 (Deserialization of untrusted data can occur in versions 3.7.0
or newer ...)
- TODO: check
+ NOT-FOR-US: ydata-profiling
CVE-2024-37061 (Remote Code Execution can occur in versions of the MLflow
platform run ...)
NOT-FOR-US: mlflow
CVE-2024-37060 (Deserialization of untrusted data can occur in versions of the
MLflow ...)
@@ -44,9 +44,9 @@ CVE-2024-37053 (Deserialization of untrusted data can occur
in versions of the M
CVE-2024-37052 (Deserialization of untrusted data can occur in versions of the
MLflow ...)
NOT-FOR-US: mlflow
CVE-2024-36858 (An arbitrary file upload vulnerability in the
/v1/app/writeFileSync in ...)
- TODO: check
+ NOT-FOR-US: Jan
CVE-2024-36857 (Jan v0.4.12 was discovered to contain an arbitrary file read
vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Jan
CVE-2024-36801 (A SQL injection vulnerability in SEMCMS v.4.8, allows a remote
attacke ...)
NOT-FOR-US: SEMCMS
CVE-2024-36800 (A SQL injection vulnerability in SEMCMS v.4.8, allows a remote
attacke ...)
@@ -62,7 +62,7 @@ CVE-2024-36548 (idccms V1.35 was discovered to contain a
Cross-Site Request Forg
CVE-2024-36547 (idccms V1.35 was discovered to contain a Cross-Site Request
Forgery (C ...)
NOT-FOR-US: idccms
CVE-2024-36400 (nano-id is a unique string ID generator for Rust. Affected
versions of ...)
- TODO: check
+ NOT-FOR-US: Rust crate nano-id
CVE-2024-35782 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
NOT-FOR-US: WordPress plugin
CVE-2024-35700 (Improper Privilege Management vulnerability in DeluxeThemes
Userpro al ...)
@@ -140,7 +140,7 @@ CVE-2024-25095 (Insertion of Sensitive Information into Log
File vulnerability i
CVE-2024-0756 (The Insert or Embed Articulate Content into WordPress plugin
through 4 ...)
NOT-FOR-US: WordPress plugin
CVE-2023-5751 (A local attacker with low privileges can read and modify any
users fil ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2023-52176 (Authentication Bypass by Spoofing vulnerability in miniorange
Malware ...)
NOT-FOR-US: WordPress plugin
CVE-2023-52147 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
@@ -637,7 +637,7 @@ CVE-2024-1324 (The QQWorld Auto Save Images plugin for
WordPress is vulnerable t
CVE-2023-6382 (The Master Slider \u2013 Responsive Touch Slider plugin for
WordPress ...)
NOT-FOR-US: WordPress plugin
CVE-2024-5565 (The Vanna library uses a prompt function to present the user
with visu ...)
- TODO: check
+ NOT-FOR-US: Vanna
CVE-2024-5564 (A vulnerability was found in libndp. This flaw allows a local
maliciou ...)
- libndp <unfixed> (bug #1072366)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2284122
@@ -674,7 +674,7 @@ CVE-2024-36843 (libmodbus v3.1.6 was discovered to contain
a heap overflow via t
[bullseye] - libmodbus <no-dsa> (Minor issue)
NOTE: https://github.com/stephane/libmodbus/issues/748
CVE-2024-36120 (javascript-deobfuscator removes common JavaScript obfuscation
techniqu ...)
- TODO: check
+ NOT-FOR-US: javascript-deobfuscator
CVE-2024-36108 (casgate is an Open Source Identity and Access Management
system. In af ...)
NOT-FOR-US: casgate
CVE-2024-35196 (Sentry is a developer-first error tracking and performance
monitoring ...)
@@ -89566,6 +89566,7 @@ CVE-2023-1420 (The Ajax Search Lite WordPress plugin
before 4.11.1, Ajax Search
NOT-FOR-US: WordPress plugin
CVE-2023-1419
RESERVED
+ NOT-FOR-US: Debezium
CVE-2023-1418 (A vulnerability classified as problematic was found in
SourceCodester ...)
NOT-FOR-US: SourceCodester Friendly Island Pizza Website and Ordering
System
CVE-2023-1417 (An issue has been discovered in GitLab affecting all versions
starting ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91d73b3b3f09d70c16fcafa049b28ea5be88ef43
--
This project does not include diff previews in email notifications.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91d73b3b3f09d70c16fcafa049b28ea5be88ef43
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
