Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fe9c1b5a by security tracker role at 2023-06-26T20:12:34+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,37 @@
+CVE-2023-3398 (Denial of Service in GitHub repository jgraph/drawio prior to
18.1.3.)
+ TODO: check
+CVE-2023-3113 (An unauthenticated XML external entity injection (XXE)
vulnerability e ...)
+ TODO: check
+CVE-2023-36631 (Lack of access control in wfc.exe in Malwarebytes Binisoft
Windows Fir ...)
+ TODO: check
+CVE-2023-36301 (Talend Data Catalog before 8.0-20230221 contain a directory
traversal ...)
+ TODO: check
+CVE-2023-36252 (An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a
remote ...)
+ TODO: check
+CVE-2023-35933 (OPenFGA is an open source authorization/permission engine
built for de ...)
+ TODO: check
+CVE-2023-35930 (SpiceDB is an open source, Google Zanzibar-inspired, database
system f ...)
+ TODO: check
+CVE-2023-35170 (Sliver is an open source cross-platform adversary
emulation/red team f ...)
+ TODO: check
+CVE-2023-34422 (A valid, authenticated LXCA user with elevated privileges may
be able ...)
+ TODO: check
+CVE-2023-34421 (A valid, authenticated LXCA user with elevated privileges may
be able ...)
+ TODO: check
+CVE-2023-34420 (A valid, authenticated LXCA user with elevated privileges may
be able ...)
+ TODO: check
+CVE-2023-34418 (A valid, authenticated LXCA user may be able to gain
unauthorized acce ...)
+ TODO: check
+CVE-2023-33580 (Phpgurukul Student Study Center Management System V1.0 is
vulnerable t ...)
+ TODO: check
+CVE-2023-33404 (An Unrestricted Upload vulnerability, due to insufficient
validation o ...)
+ TODO: check
+CVE-2023-33176 (BigBlueButton is an open source virtual classroom designed to
help tea ...)
+ TODO: check
+CVE-2023-2993 (A valid, authenticated user with limited privileges may be able
to use ...)
+ TODO: check
+CVE-2023-2992 (An unauthenticated denial of service vulnerability exists in
the SMM v ...)
+ TODO: check
CVE-2023-36675 (An issue was discovered in MediaWiki before 1.35.11, 1.36.x
through 1. ...)
- mediawiki <unfixed>
NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/921452
@@ -982,7 +1016,7 @@ CVE-2023-XXXX [RUSTSEC-2023-0038: Out-of-bounds array
access leads to panic]
CVE-2023-3193 (Cross-site scripting (XSS) vulnerability in the Layout module's
SEO co ...)
NOT-FOR-US: Liferay
CVE-2023-3138 [Buffer overflows in InitExt.c in libX11]
- {DSA-5433-1}
+ {DSA-5433-1 DLA-3472-1}
- libx11 2:1.8.6-1 (bug #1038133)
NOTE: https://www.openwall.com/lists/oss-security/2023/06/15/2
NOTE:
https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c
@@ -1380,7 +1414,8 @@ CVE-2023-29167 (Out-of-bound reads vulnerability exists
in FRENIC RHC Loader v1.
NOT-FOR-US: FRENIC RHC Loader
CVE-2023-29160 (Stack-based buffer overflow vulnerability exists in FRENIC RHC
Loader ...)
NOT-FOR-US: FRENIC RHC Loader
-CVE-2023-36661 [Parsing of KeyInfo elements can cause remote resource access]
+CVE-2023-36661 (Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and
Shibboleth ...)
+ {DSA-5432-1 DLA-3464-1}
- xmltooling 3.2.4-1 (bug #1037948)
NOTE: https://shibboleth.net/community/advisories/secadv_20230612.txt
NOTE:
https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=6080f6343f98fec085bc0fd746913ee418cc9d30
@@ -5391,8 +5426,8 @@ CVE-2023-2292
RESERVED
CVE-2023-2291 (Static credentials exist in the PostgreSQL data used in
ManageEngine A ...)
NOT-FOR-US: Zoho
-CVE-2023-2290
- RESERVED
+CVE-2023-2290 (A potential vulnerability in the LenovoFlashDeviceInterface SMI
handle ...)
+ TODO: check
CVE-2023-2289 (The wordpress vertical image slider plugin for WordPress is
vulnerable ...)
NOT-FOR-US: WordPress plugin
CVE-2023-2288 (The Otter WordPress plugin before 2.2.6 does not sanitize some
user-co ...)
@@ -7673,8 +7708,8 @@ CVE-2023-2006 (A race condition was found in the Linux
kernel's RxRPC network pr
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-439/
NOTE:
https://git.kernel.org/linus/3bcd6c7eaa53b56c3f584da46a1f7652e759d0e5 (6.1-rc7)
-CVE-2023-2005
- RESERVED
+CVE-2023-2005 (Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable
Security ...)
+ TODO: check
CVE-2023-2004
REJECTED
CVE-2023-2003
@@ -8388,8 +8423,8 @@ CVE-2023-30263
RESERVED
CVE-2023-30262 (An issue found in MIM software Inc MIM License Server and
MIMpacs serv ...)
NOT-FOR-US: MIM software Inc MIM License Server and MIMpacs services
-CVE-2023-30261
- RESERVED
+CVE-2023-30261 (Command Injection vulnerability in OpenWB 1.6 and 1.7 allows
remote at ...)
+ TODO: check
CVE-2023-30260 (Command injection vulnerability in RaspAP raspap-webgui 2.8.8
and earl ...)
TODO: check
CVE-2023-30259
@@ -10294,8 +10329,8 @@ CVE-2023-29461 (An arbitrary code execution
vulnerability contained in Rockwell
NOT-FOR-US: Rockwell Automation
CVE-2023-29460 (An arbitrary code execution vulnerability contained in
Rockwell Automa ...)
NOT-FOR-US: Rockwell Automation
-CVE-2023-29459
- RESERVED
+CVE-2023-29459 (The laola.redbull application through 5.1.9-R for Android
exposes the ...)
+ TODO: check
CVE-2023-29458
RESERVED
CVE-2023-29457
@@ -10326,9 +10361,9 @@ CVE-2023-29445
RESERVED
CVE-2023-29444
RESERVED
-CVE-2023-29443 (Zoho ManageEngine ServiceDesk Plus through 14104 allows admin
users to ...)
+CVE-2023-29443 (Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk
Plus MSP ...)
NOT-FOR-US: Zoho ManageEngine
-CVE-2023-29442 (Zoho ManageEngine Applications Manager through 16390 allows
DOM XSS.)
+CVE-2023-29442 (Zoho ManageEngine Applications Manager before 16400 allows
proxy.html ...)
NOT-FOR-US: Zoho ManageEngine
CVE-2023-29441
RESERVED
@@ -10336,30 +10371,30 @@ CVE-2023-29440
RESERVED
CVE-2023-29439 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
FooPlugi ...)
NOT-FOR-US: FooGallery
-CVE-2023-29438
- RESERVED
-CVE-2023-29437
- RESERVED
-CVE-2023-29436
- RESERVED
-CVE-2023-29435
- RESERVED
-CVE-2023-29434
- RESERVED
+CVE-2023-29438 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Eric ...)
+ TODO: check
+CVE-2023-29437 (Auth. (contributor+) Stored Cross-Site Scripting (XSS)
vulnerability i ...)
+ TODO: check
+CVE-2023-29436 (Auth. (contributor+) Stored Cross-Site Scripting (XSS)
vulnerability i ...)
+ TODO: check
+CVE-2023-29435 (Auth. (contributor+) Stored Cross-Site Scripting (XSS)
vulnerability i ...)
+ TODO: check
+CVE-2023-29434 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Fanc ...)
+ TODO: check
CVE-2023-29433
RESERVED
CVE-2023-29432
RESERVED
CVE-2023-29431
RESERVED
-CVE-2023-29430
- RESERVED
+CVE-2023-29430 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
CTHtheme ...)
+ TODO: check
CVE-2023-29429
RESERVED
CVE-2023-29428
RESERVED
-CVE-2023-29427
- RESERVED
+CVE-2023-29427 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
TMS Book ...)
+ TODO: check
CVE-2023-29426
RESERVED
CVE-2023-29425
@@ -11548,7 +11583,7 @@ CVE-2023-29086 (An issue was discovered in Samsung
Exynos Mobile Processor, Auto
NOT-FOR-US: Samsung
CVE-2023-29085 (An issue was discovered in Samsung Exynos Mobile Processor,
Automotive ...)
NOT-FOR-US: Samsung
-CVE-2023-29084 (Zoho ManageEngine ADManager Plus through 7180 allows for
authenticated ...)
+CVE-2023-29084 (Zoho ManageEngine ADManager Plus before 7181 allows for
authenticated ...)
NOT-FOR-US: Zoho ManageEngine
CVE-2023-29083
RESERVED
@@ -13812,8 +13847,8 @@ CVE-2023-28486 (Sudo before 1.9.13 does not escape
control characters in log mes
[bullseye] - sudo <no-dsa> (Minor issue)
[buster] - sudo <no-dsa> (Minor issue)
NOTE:
https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
-CVE-2023-28485
- RESERVED
+CVE-2023-28485 (A stored cross-site scripting (Stored XSS) vulnerability in
file previ ...)
+ TODO: check
CVE-2023-28484 (In libxml2 before 2.10.4, parsing of certain invalid XSD
schemas can l ...)
{DSA-5391-1 DLA-3405-1}
- libxml2 2.9.14+dfsg-1.2 (bug #1034436)
@@ -18231,8 +18266,8 @@ CVE-2023-27084 (Permissions vulnerability found in
isoftforce Dreamer CMS v.4.0.
NOT-FOR-US: Dreamer CMS
CVE-2023-27083 (An issue discovered in /admin.php in Pluck CMS 4.7.15 through
4.7.16-d ...)
TODO: check
-CVE-2023-27082
- RESERVED
+CVE-2023-27082 (Cross Site Scripting (XSS) vulnerability in /admin.php in
Pluck CMS 4. ...)
+ TODO: check
CVE-2023-27081
RESERVED
CVE-2023-27080
@@ -20438,18 +20473,18 @@ CVE-2022-48340 (In Gluster GlusterFS 11.0, there is
an xlators/cluster/dht/src/d
[bullseye] - glusterfs <no-dsa> (Minor issue)
[buster] - glusterfs <no-dsa> (Minor issue)
NOTE: https://github.com/gluster/glusterfs/issues/3732
-CVE-2022-48336
- RESERVED
-CVE-2022-48335
- RESERVED
-CVE-2022-48334
- RESERVED
-CVE-2022-48333
- RESERVED
-CVE-2022-48332
- RESERVED
-CVE-2022-48331
- RESERVED
+CVE-2022-48336 (Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a
PRDiagPars ...)
+ TODO: check
+CVE-2022-48335 (Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a
PRDiagVeri ...)
+ TODO: check
+CVE-2022-48334 (Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a
drm_verify ...)
+ TODO: check
+CVE-2022-48333 (Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a
drm_verify ...)
+ TODO: check
+CVE-2022-48332 (Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a
drm_save_k ...)
+ TODO: check
+CVE-2022-48331 (Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a
drm_save_k ...)
+ TODO: check
CVE-2022-48339 (An issue was discovered in GNU Emacs through 28.2.
htmlfontify.el has ...)
{DSA-5360-1 DLA-3416-1}
- emacs 1:28.2+1-11 (bug #1031730)
@@ -23284,10 +23319,10 @@ CVE-2023-25309 (Cross Site Scripting (XSS)
Vulnerability in Fetlife rollout-ui v
NOT-FOR-US: Fetlife rollout-ui
CVE-2023-25308
RESERVED
-CVE-2023-25307
- RESERVED
-CVE-2023-25306
- RESERVED
+CVE-2023-25307 (nothub mrpack-install <= v0.16.2 is vulnerable to Directory
Traversal.)
+ TODO: check
+CVE-2023-25306 (MultiMC Launcher <= 0.6.16 is vulnerable to Directory
Traversal.)
+ TODO: check
CVE-2023-25305 (PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal.
A mrpac ...)
NOT-FOR-US: PolyMC Launcher
CVE-2023-25304 (Prism Launcher <= 6.1 is vulnerable to Directory Traversal.)
@@ -60141,8 +60176,8 @@ CVE-2022-40012
RESERVED
CVE-2022-40011 (Cross Site Scripting (XSS) vulnerability in typora through
1.38 allows ...)
NOT-FOR-US: typora
-CVE-2022-40010
- RESERVED
+CVE-2022-40010 (Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi
was dis ...)
+ TODO: check
CVE-2022-40009 (SWFTools commit 772e55a was discovered to contain a
heap-use-after-fre ...)
- swftools <removed>
NOTE: https://github.com/matthiaskramm/swftools/issues/190
@@ -155600,8 +155635,8 @@ CVE-2021-31637 (An issue found in UwAmp v.1.1, 1.2,
1.3, 2.0, 2.1, 2.2, 2.2.1, 3
NOT-FOR-US: UwAmp
CVE-2021-31636
RESERVED
-CVE-2021-31635
- RESERVED
+CVE-2021-31635 (Server-Side Template Injection (SSTI) vulnerability in jFinal
v.4.9.08 ...)
+ TODO: check
CVE-2021-31634
RESERVED
CVE-2021-31633
@@ -208785,12 +208820,12 @@ CVE-2020-23068
RESERVED
CVE-2020-23067
RESERVED
-CVE-2020-23066
- RESERVED
-CVE-2020-23065
- RESERVED
-CVE-2020-23064
- RESERVED
+CVE-2020-23066 (Cross Site Scripting vulnerability in TinyMCE v.4.9.6 and
before and v ...)
+ TODO: check
+CVE-2020-23065 (Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish
Platform ...)
+ TODO: check
+CVE-2020-23064 (Cross Site Scripting vulnerability in jQuery v.2.2.0 thru
v.3.5.0 allo ...)
+ TODO: check
CVE-2020-23063
RESERVED
CVE-2020-23062
@@ -214923,8 +214958,8 @@ CVE-2020-20212 (Mikrotik RouterOs 6.44.5 (long-term
tree) suffers from a memory
NOT-FOR-US: Mikrotik
CVE-2020-20211 (Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an
assertion fa ...)
NOT-FOR-US: Mikrotik
-CVE-2020-20210
- RESERVED
+CVE-2020-20210 (Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via
/admin/a ...)
+ TODO: check
CVE-2020-20209
RESERVED
CVE-2020-20208
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe9c1b5a79693cea1838fb6db43df71e20bc6db5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe9c1b5a79693cea1838fb6db43df71e20bc6db5
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
