Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
08242560 by security tracker role at 2024-11-11T08:12:03+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,91 @@
+CVE-2024-52358 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52357 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52356 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52355 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52354 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52353 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52352 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52351 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-52350 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-51882 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2024-51845 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2024-51843 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2024-51837 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2024-51820 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
+ TODO: check
+CVE-2024-51793 (Unrestricted Upload of File with Dangerous Type vulnerability
in Webfu ...)
+ TODO: check
+CVE-2024-51792 (Unrestricted Upload of File with Dangerous Type vulnerability
in Dang ...)
+ TODO: check
+CVE-2024-51791 (Unrestricted Upload of File with Dangerous Type vulnerability
in Made ...)
+ TODO: check
+CVE-2024-51790 (Unrestricted Upload of File with Dangerous Type vulnerability
in Team ...)
+ TODO: check
+CVE-2024-51789 (Unrestricted Upload of File with Dangerous Type vulnerability
in UjW0L ...)
+ TODO: check
+CVE-2024-51788 (Unrestricted Upload of File with Dangerous Type vulnerability
in Joshu ...)
+ TODO: check
+CVE-2024-51575 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-51574 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-51573 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-51572 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-51571 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
+ TODO: check
+CVE-2024-48939 (Insufficient validation performed on the REST API License file
in Paxt ...)
+ TODO: check
+CVE-2024-41992 (Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0
allows OS c ...)
+ TODO: check
+CVE-2024-38826 (Authenticated users can upload specifically crafted files to
leak serv ...)
+ TODO: check
+CVE-2024-11066 (The D-Link DSL6740C modem has an OS Command Injection
vulnerability, a ...)
+ TODO: check
+CVE-2024-11065 (The D-Link DSL6740C modem has an OS Command Injection
vulnerability, a ...)
+ TODO: check
+CVE-2024-11064 (The D-Link DSL6740C modem has an OS Command Injection
vulnerability, a ...)
+ TODO: check
+CVE-2024-11063 (The D-Link DSL6740C modem has an OS Command Injection
vulnerability, a ...)
+ TODO: check
+CVE-2024-11062 (The D-Link DSL6740C modem has an OS Command Injection
vulnerability, a ...)
+ TODO: check
+CVE-2024-11061 (A vulnerability classified as critical was found in Tenda AC10
16.03.1 ...)
+ TODO: check
+CVE-2024-11060 (A vulnerability classified as critical has been found in
Jinher Networ ...)
+ TODO: check
+CVE-2024-11059 (A vulnerability was found in Project Worlds Free Download
Online Shopp ...)
+ TODO: check
+CVE-2024-11058 (A vulnerability was found in CodeAstro Real Estate Management
System u ...)
+ TODO: check
+CVE-2024-11021 (Webopac from Grand Vice info has Stored Cross-site Scripting
vulnerabi ...)
+ TODO: check
+CVE-2024-11020 (Webopac from Grand Vice info has a SQL Injection
vulnerability, allowi ...)
+ TODO: check
+CVE-2024-11019 (Webopac from Grand Vice info has a Reflected Cross-site
Scripting vuln ...)
+ TODO: check
+CVE-2024-11018 (Webopac from Grand Vice info does not properly validate
uploaded file ...)
+ TODO: check
+CVE-2024-11017 (Webopac from Grand Vice info does not properly validate
uploaded file ...)
+ TODO: check
+CVE-2024-11016 (Webopac from Grand Vice info has a SQL Injection
vulnerability, allowi ...)
+ TODO: check
+CVE-2023-40457 (The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS)
30.7.1.1 allo ...)
+ TODO: check
CVE-2024-51584 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
NOT-FOR-US: WordPress plugin
CVE-2024-51583 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
@@ -3196,17 +3284,17 @@ CVE-2024-10108 (The WPAdverts \u2013 Classifieds Plugin
plugin for WordPress is
NOT-FOR-US: WordPress plugin
CVE-2023-5816 (The Code Explorer plugin for WordPress is vulnerable to
arbitrary exte ...)
NOT-FOR-US: WordPress plugin
-CVE-2024-46956 [PostScript interpreter - fix buffer length check]
+CVE-2024-46956 (An issue was discovered in psi/zfile.c in Artifex Ghostscript
before 1 ...)
- ghostscript 10.04.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f4151f12db32cd3ed26c24327de714bf2c3ed6ca
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c
(ghostpdl-10.04.0)
-CVE-2024-46955 [PS interpreter - check Indexed colour space index]
+CVE-2024-46955 (An issue was discovered in psi/zcolor.c in Artifex Ghostscript
before ...)
- ghostscript 10.04.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707990
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b792fe67aef22f1a4117457461b8ba6
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ca1fc2aefe9796e321d0589afe7efb35063c8b2a
(ghostpdl-10.04.0)
-CVE-2024-46954 [Fix decode_utf8 to forbid overlong encodings]
+CVE-2024-46954 (An issue was discovered in decode_utf8 in base/gp_utf8.c in
Artifex Gh ...)
- ghostscript 10.04.0~dfsg-1
[bookworm] - ghostscript <not-affected> (Vulnerable code introduced
later)
[bullseye] - ghostscript <not-affected> (Vulnerable code introduced
later)
@@ -3215,17 +3303,17 @@ CVE-2024-46954 [Fix decode_utf8 to forbid overlong
encodings]
NOTE: Introduced when making previously windows specific functions
generically available.
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=55f587dd039282316f512e1bea64218fd991f934
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=282f691f5e57b6bf55ba51ad8c2be2cce8edb938
(ghostpdl-10.04.0)
-CVE-2024-46953 [Check for overflow validating format string]
+CVE-2024-46953 (An issue was discovered in base/gsdevice.c in Artifex
Ghostscript befo ...)
- ghostscript 10.04.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707793
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a
(ghostpdl-10.04.0)
-CVE-2024-46952 [PDF interpreter - sanitise W array values in Xref streams]
+CVE-2024-46952 (An issue was discovered in pdf/pdf_xref.c in Artifex
Ghostscript befor ...)
- ghostscript 10.04.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=708001
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b1f0827c30f59a2dcbc8a39e42cace7a1de35f7f
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1fb76aaddac34530242dfbb9579d9997dae41264
(ghostpdl-10.04.0)
-CVE-2024-46951 [PS interpreter - check the type of the Pattern Implementation]
+CVE-2024-46951 (An issue was discovered in psi/zcolor.c in Artifex Ghostscript
before ...)
- ghostscript 10.04.0~dfsg-1
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707991
NOTE:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8
@@ -14412,7 +14500,7 @@ CVE-2023-42772 (Untrusted pointer dereference in UEFI
firmware for some Intel(R)
NOT-FOR-US: Intel
CVE-2023-41833 (A race condition in UEFI firmware for some Intel(R) processors
may all ...)
NOT-FOR-US: Intel
-CVE-2024-46613 [Integer Overflow to Buffer Overflow vulnerability in
"string_free_split" functions]
+CVE-2024-46613 (WeeChat before 4.4.2 has an integer overflow and resultant
buffer over ...)
- weechat 4.4.2-1 (bug #1081942)
[bookworm] - weechat <no-dsa> (Minor issue)
[bullseye] - weechat <postponed> (Minor issue)
@@ -246902,8 +246990,7 @@ CVE-2021-41739 (A OS Command Injection vulnerability
was discovered in Artica Pr
NOT-FOR-US: Artica Web Proxy
CVE-2021-41738 (ZeroShell 3.9.5 has a command injection vulnerability in
/cgi-bin/kerb ...)
NOT-FOR-US: ZeroShell
-CVE-2021-41737
- RESERVED
+CVE-2021-41737 (In Faust 2.23.1, an input file with the lines "// r
visualisation tCst ...)
- faust <unfixed> (bug #1014783)
[bookworm] - faust <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - faust <no-dsa> (Minor issue)
@@ -262864,8 +262951,7 @@ CVE-2021-35474 (Stack-based Buffer Overflow
vulnerability in cachekey plugin of
NOTE: https://github.com/apache/trafficserver/pull/7945 (8.1.x)
NOTE:
https://github.com/apache/trafficserver/commit/5a9339d7bc65e1c2d8d2a0fc80bb051daf3cdb0b
(master)
NOTE:
https://github.com/apache/trafficserver/commit/b82a3d192f995fb9d78e1c44d51d9acca4783277
(8.1.x)
-CVE-2021-35473 [Access token lifetime is not verified with OAuth2 Handler]
- RESERVED
+CVE-2021-35473 (An issue was discovered in LemonLDAP::NG before 2.0.12. There
is a mis ...)
- lemonldap-ng 2.0.11+ds-4
[buster] - lemonldap-ng <not-affected> (OAuth2 Handler introduced later)
[stretch] - lemonldap-ng <not-affected> (OAuth2 Handler introduced
later)
@@ -358251,16 +358337,15 @@ CVE-2020-10372 (Ramp AltitudeCDN Altimeter before
2.4.0 allows authenticated Sto
NOT-FOR-US: Ramp AltitudeCDN Altimeter
CVE-2020-10371
RESERVED
-CVE-2020-10370
- RESERVED
+CVE-2020-10370 (Certain Cypress (and Broadcom) Wireless Combo chips such as
CYW43455, ...)
- bluez-firmware <not-affected> (BCM4345C0.hcd introduced already in
fixed version in Debian with bluez-firmware/1.2-6)
NOTE:
https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a
-CVE-2020-10369
- RESERVED
-CVE-2020-10368
- RESERVED
-CVE-2020-10367
- RESERVED
+CVE-2020-10369 (Certain Cypress (and Broadcom) Wireless Combo chips, when a
January 20 ...)
+ TODO: check
+CVE-2020-10368 (Certain Cypress (and Broadcom) Wireless Combo chips, when a
January 20 ...)
+ TODO: check
+CVE-2020-10367 (Certain Cypress (and Broadcom) Wireless Combo chips, when a
January 20 ...)
+ TODO: check
CVE-2020-10366 (LogicalDoc before 8.3.3 allows /servlet.gupld Directory
Traversal, a d ...)
NOT-FOR-US: LogicalDoc
CVE-2020-10365 (LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc
populates the ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08242560b11dab9919a53401fb656152c809319d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08242560b11dab9919a53401fb656152c809319d
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
