Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
27e2fbd1 by security tracker role at 2025-06-11T20:12:54+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,81 @@
+CVE-2025-6002 (An unrestricted file upload vulnerability exists in the Product
Image ...)
+ TODO: check
+CVE-2025-6001 (A Cross-Site Request Forgery (CSRF) vulnerability exists in the
produc ...)
+ TODO: check
+CVE-2025-5687 (A vulnerability in Mozilla VPN on macOS allows privilege
escalation fr ...)
+ TODO: check
+CVE-2025-5144 (The The Events Calendar plugin for WordPress is vulnerable to
Stored C ...)
+ TODO: check
+CVE-2025-4922 (Nomad Community and Nomad Enterprise (\u201cNomad\u201d)
prefix-based ...)
+ TODO: check
+CVE-2025-4605 (A maliciously crafted .usdc file, when loaded through Autodesk
Maya, c ...)
+ TODO: check
+CVE-2025-4573 (Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x
<= 10.5 ...)
+ TODO: check
+CVE-2025-4315 (The CubeWP \u2013 All-in-One Dynamic Content Framework plugin
for Word ...)
+ TODO: check
+CVE-2025-4128 (Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to
proper ...)
+ TODO: check
+CVE-2025-49150 (Cursor is a code editor built for programming with AI. Prior
to 0.51.0 ...)
+ TODO: check
+CVE-2025-49148 (ClipShare is a lightweight and cross-platform tool for
clipboard shari ...)
+ TODO: check
+CVE-2025-49146 (pgjdbc is an open source postgresql JDBC Driver. From 42.7.4
and until ...)
+ TODO: check
+CVE-2025-48448 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
+ TODO: check
+CVE-2025-48447 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2025-48446 (Incorrect Authorization vulnerability in Drupal Commerce
Alphabank Red ...)
+ TODO: check
+CVE-2025-48445 (Incorrect Authorization vulnerability in Drupal Commerce
Eurobank (Red ...)
+ TODO: check
+CVE-2025-48444 (Missing Authorization vulnerability in Drupal Quick Node Block
allows ...)
+ TODO: check
+CVE-2025-48013 (Missing Authorization vulnerability in Drupal Quick Node Block
allows ...)
+ TODO: check
+CVE-2025-41663 (An unauthenticated remote attacker in a man-in-the-middle
position can ...)
+ TODO: check
+CVE-2025-41662 (An unauthenticated remote attacker can execute arbitrary
commands with ...)
+ TODO: check
+CVE-2025-41661 (An unauthenticated remote attacker can execute arbitrary
commands with ...)
+ TODO: check
+CVE-2025-40915 (Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random
number sour ...)
+ TODO: check
+CVE-2025-40914 (Perl CryptX before version 0.087 contains a dependency that
may be sus ...)
+ TODO: check
+CVE-2025-40912 (CryptX for Perl before version 0.065 contains a dependency
that may be ...)
+ TODO: check
+CVE-2025-3473 (IBM Security Guardium 12.1 could allow a local privileged user
to esca ...)
+ TODO: check
+CVE-2025-3302 (The Xagio SEO \u2013 AI Powered SEO plugin for WordPress is
vulnerable ...)
+ TODO: check
+CVE-2025-35941 (A password is exposed locally.)
+ TODO: check
+CVE-2025-32711 (Ai command injection in M365 Copilot allows an unauthorized
attacker t ...)
+ TODO: check
+CVE-2025-32466 (A SQL injection vulnerability in RSMediaGallery! component
1.7.4 - 2.1 ...)
+ TODO: check
+CVE-2025-32465 (A stored XSS vulnerability in RSTickets! component 1.9.12 -
3.3.0 for ...)
+ TODO: check
+CVE-2025-30085 (Remote code execution vulnerability in RSForm!pro component
3.0.0 - 3. ...)
+ TODO: check
+CVE-2025-26412 (The SIMCom SIM7600G modem supports an undocumented AT command,
which a ...)
+ TODO: check
+CVE-2025-26383 (The iSTAR Configuration Utility (ICU) tool leaks memory, which
could r ...)
+ TODO: check
+CVE-2025-25032 (IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,
12.0.0, 1 ...)
+ TODO: check
+CVE-2025-1699 (An incorrect default permissions vulnerability was reported in
the Mot ...)
+ TODO: check
+CVE-2025-1698 (Null pointer exception vulnerabilities were reported in the
fingerprin ...)
+ TODO: check
+CVE-2025-0923 (IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,
12.0.0, 1 ...)
+ TODO: check
+CVE-2025-0917 (IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,
12.0.0, 1 ...)
+ TODO: check
+CVE-2025-0163 (IBM Security Verify Access Appliance and Docker 10.0 through
10.0.8 co ...)
+ TODO: check
CVE-2025-5991 (There is a "Use After Free" vulnerability in Qt's
QHttp2ProtocolHandle ...)
- qt6-base <unfixed>
- qtbase-opensource-src <unfixed>
@@ -523,14 +601,14 @@ CVE-2024-1244 (Improper input validation in the OSSEC
HIDS agent for Windows pri
NOT-FOR-US: OSSEC-HIDS Agent
CVE-2024-1243 (Improper input validation in the Wazuh agent for Windows prior
to vers ...)
NOT-FOR-US: Wazuh agent for Windows
-CVE-2025-5986
+CVE-2025-5986 (A crafted HTML email using mailbox:/// links can trigger
automatic, un ...)
- thunderbird <unfixed>
[bookworm] - thunderbird <postponed> (Minor issue, fix along with June
update)
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/#CVE-2025-5986
-CVE-2025-49710
+CVE-2025-49710 (An integer overflow was present in `OrderedHashTable` used by
the Java ...)
- firefox 139.0.4-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-47/#CVE-2025-49710
-CVE-2025-49709
+CVE-2025-49709 (Certain canvas operations could have lead to memory
corruption. This v ...)
- firefox 139.0.4-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-47/#CVE-2025-49709
CVE-2025-49091 (KDE Konsole before 25.04.2 allows remote code execution in a
certain s ...)
@@ -2332,7 +2410,7 @@ CVE-2025-27445 (A path traversal vulnerability in
RSFirewall component 2.9.7 - 3
NOT-FOR-US: Joomla
CVE-2025-0691 (Improper access control in permissions component in Devolutions
Server ...)
NOT-FOR-US: Devolutions
-CVE-2025-22874
+CVE-2025-22874 (Calling Verify with a VerifyOptions.KeyUsages that contains
ExtKeyUsag ...)
- golang-1.24 <unfixed> (bug #1107364)
- golang-1.23 <not-affected> (Vulnerable code not present)
- golang-1.19 <not-affected> (Vulnerable code not present)
@@ -2340,7 +2418,7 @@ CVE-2025-22874
NOTE: https://github.com/golang/go/issues/73612
NOTE: Fixed by:
https://github.com/golang/go/commit/03811ab1b31525e8d779997db169c6fedab7c505
(go1.24.4)
NOTE: Introduced with:
https://github.com/golang/go/commit/e8d95619978c4602d4446f113b3b69b7a22308fa
(go1.24rc1)
-CVE-2025-0913
+CVE-2025-0913 (os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on
Unix and ...)
- golang-1.24 <not-affected> (Only affects Go on Windows)
- golang-1.23 <not-affected> (Only affects Go on Windows)
- golang-1.19 <not-affected> (Only affects Go on Windows)
@@ -2348,7 +2426,7 @@ CVE-2025-0913
NOTE: https://github.com/golang/go/issues/73702
NOTE: Fixed by:
https://github.com/golang/go/commit/9f9cf28f8fe67e6c17123cae2d89f116504f2be1
(go1.24.4)
NOTE: Fixed by:
https://github.com/golang/go/commit/c2c89d95516d2a6b51aa1766ed5f76e542ab282c
(go1.23.10)
-CVE-2025-4673
+CVE-2025-4673 (Proxy-Authorization and Proxy-Authenticate headers persisted on
cross- ...)
- golang-1.24 <unfixed> (bug #1107364)
- golang-1.23 <unfixed> (bug #1107390)
- golang-1.19 <removed>
@@ -4691,7 +4769,7 @@ CVE-2025-5145 (A vulnerability, which was classified as
critical, was found in N
NOT-FOR-US: Netcore
CVE-2025-5140 (A vulnerability classified as critical has been found in Seeyon
Zhiyua ...)
NOT-FOR-US: Seeyon Zhiyuan OA Web Application System
-CVE-2025-5139 (A vulnerability was found in Qualitor 8.20. It has been rated
as criti ...)
+CVE-2025-5139 (A vulnerability was found in Qualitor 8.20/8.24. It has been
rated as ...)
NOT-FOR-US: Qualitor
CVE-2025-5138 (A vulnerability was found in Bitwarden up to 2.25.1. It has
been decla ...)
NOT-FOR-US: Bitwarden
@@ -5428,6 +5506,7 @@ CVE-2025-45753 (A vulnerability in Vtiger CRM Open Source
Edition v8.3.0 allows
CVE-2025-44040 (An issue in OrangeHRM v.5.7 allows an attacker to escalate
privileges ...)
NOT-FOR-US: OrangeHRM
CVE-2025-3887 (GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote
Code E ...)
+ {DSA-5941-1}
- gst-plugins-bad1.0 1.26.1-1 (bug #1106285)
NOTE: https://gstreamer.freedesktop.org/security/sa-2025-0001.html
NOTE:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d0e18d6353e4e448ccf3b06a967b394e664dd0b5
(main)
@@ -8239,7 +8318,8 @@ CVE-2025-3909 (Thunderbird's handling of the
X-Mozilla-External-Attachment-URL h
{DSA-5921-1 DLA-4167-1}
- thunderbird 1:128.10.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3909
-CVE-2025-3877 (A crafted HTML email using mailbox:/// links can trigger
automatic, un ...)
+CVE-2025-3877
+ REJECTED
{DSA-5921-1 DLA-4167-1}
- thunderbird 1:128.10.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3877
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e2fbd10a0262cbd025311ecc74b62958f1214a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e2fbd10a0262cbd025311ecc74b62958f1214a
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
