Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
55e3a44b by Moritz Mühlenhoff at 2024-10-18T19:13:24+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -61,7 +61,7 @@ CVE-2024-38820 (The fix for CVE-2022-22968 made
disallowedFieldspatterns in Data
CVE-2024-33453 (Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote
attacke ...)
NOT-FOR-US: esp-idf
CVE-2024-30875 (Cross Site Scripting vulnerability in JavaScript Library
jquery-ui v.1 ...)
- - jqueryui <unfixed>
+ - jqueryui <unfixed> (bug #1085379)
NOTE: https://github.com/Ant1sec-ops/CVE-2024-30875
CVE-2024-27766 (An issue in MYSQL MariaDB v.11.1 allows a remote attacker to
execute a ...)
NOTE: Dubious mysql/mariadb issue, reached out to upstream
@@ -378,15 +378,15 @@ CVE-2024-48758 (dingfanzu CMS V1.0 was discovered to
contain a Cross-Site Reques
CVE-2024-48180 (ClassCMS <=4.8 is vulnerable to file inclusion in the nowView
method i ...)
NOT-FOR-US: ClassCMS
CVE-2024-47889 (Action Mailer is a framework for designing email service
layers. Start ...)
- - rails <unfixed>
+ - rails <unfixed> (bug #1085376)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
NOTE:
https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9
CVE-2024-47888 (Action Text brings rich text content and editing to Rails.
Starting in ...)
- - rails <unfixed>
+ - rails <unfixed> (bug #1085376)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
NOTE:
https://github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468
CVE-2024-47887 (Action Pack is a framework for handling and responding to web
requests ...)
- - rails <unfixed>
+ - rails <unfixed> (bug #1085376)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
NOTE:
https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
CVE-2024-46213 (REDAXO CMS v2.11.0 was discovered to contain a remote code
execution ( ...)
@@ -414,7 +414,7 @@ CVE-2024-9444 (The ElementsReady Addons for Elementor
plugin for WordPress is vu
CVE-2024-9348 (Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub
source ...)
NOT-FOR-US: Docker Desktop
CVE-2024-9143 (Issue summary: Use of the low-level GF(2^m) elliptic curve APIs
with u ...)
- - openssl <unfixed>
+ - openssl <unfixed> (bug #1085378)
[bookworm] - openssl <postponed> (Minor issue, fix along in next update)
NOTE: https://openssl-library.org/news/secadv/20241016.txt
NOTE:
https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712
@@ -529,7 +529,7 @@ CVE-2024-45072 (IBM WebSphere Application Server 8.5 and
9.0 is vulnerable to an
CVE-2024-45071 (IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to
stored c ...)
NOT-FOR-US: IBM
CVE-2024-41128 (Action Pack is a framework for handling and responding to web
requests ...)
- - rails <unfixed>
+ - rails <unfixed> (bug #1085376)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
NOTE:
https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
CVE-2024-38814 (An authenticated SQL injection vulnerability in VMware HCX was
private ...)
@@ -945,7 +945,7 @@ CVE-2024-45272 (An unauthenticated remote attacker can
perform a brute-force att
CVE-2024-45271 (An unauthenticated local attacker can gain admin privileges by
deployi ...)
NOT-FOR-US: MB connect line GmbH
CVE-2024-44337 (The package `github.com/gomarkdown/markdown` is a Go library
for parsi ...)
- - golang-github-gomarkdown-markdown <unfixed>
+ - golang-github-gomarkdown-markdown <unfixed> (bug #1085377)
NOTE: https://github.com/Brinmon/CVE-2024-44337
NOTE:
https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252
CVE-2024-41344 (A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13
allows attac ...)
@@ -1199,7 +1199,7 @@ CVE-2024-35518 (Netgear EX6120 v1.0.0.68 is vulnerable to
Command Injection in g
CVE-2024-30117 (A dynamic search for a prerequisite library could allow the
possibilit ...)
NOT-FOR-US: HCL
CVE-2024-21535 (Versions of the package markdown-to-jsx before 7.4.0 are
vulnerable to ...)
- - node-markdown-to-jsx <unfixed>
+ - node-markdown-to-jsx <unfixed> (bug #1085375)
NOTE: https://security.snyk.io/vuln/SNYK-JS-MARKDOWNTOJSX-6258886
NOTE:
https://github.com/quantizor/markdown-to-jsx/commit/8eb74da825c0d8d2e9508d73c672bcae36ba555a
(v7.4.0)
CVE-2024-0129 (NVIDIA NeMo contains a vulnerability in SaveRestoreConnector
where a u ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55e3a44b91b641705fbcec231fc2f13d40f2cacf
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55e3a44b91b641705fbcec231fc2f13d40f2cacf
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
