Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
baee9563 by Salvatore Bonaccorso at 2024-11-13T11:33:19+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -135,59 +135,59 @@ CVE-2024-11110 (Inappropriate implementation in
Extensions in Google Chrome prio
- chromium <unfixed>
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2024-10887 (The NiceJob plugin for WordPress is vulnerable to Stored
Cross-Site Sc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10882 (The Product Delivery Date for WooCommerce \u2013 Lite plugin
for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10877 (The AFI \u2013 The Easiest Integration Plugin plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10854 (The Buy one click WooCommerce plugin for WordPress is
vulnerable to un ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10853 (The Buy one click WooCommerce plugin for WordPress is
vulnerable to un ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10852 (The Buy one click WooCommerce plugin for WordPress is
vulnerable to un ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10851 (The Razorpay Payment Button Plugin plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10850 (The Razorpay Payment Button Elementor Plugin plugin for
WordPress is v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10828 (The Advanced Order Export For WooCommerce plugin for WordPress
is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10820 (The WooCommerce Upload Files plugin for WordPress is
vulnerable to arb ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10816 (The LUNA RADIO PLAYER plugin for WordPress is vulnerable to
Directory ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10802 (The Hash Elements plugin for WordPress is vulnerable to
unauthorized a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10800 (The WordPress User Extra Fields plugin for WordPress is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10794 (The Boostify Header Footer Builder for Elementor plugin for
WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10778 (The BuddyPress Builder for Elementor \u2013 BuddyBuilder
plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10717 (The Styler for Ninja Forms plugin for WordPress is vulnerable
to unaut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10686 (The Design for Contact Form 7 Style WordPress Plugin \u2013
CF7 WOW St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10684 (The Kognetiks Chatbot for WordPress plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10629 (The GPX Viewer plugin for WordPress is vulnerable to arbitrary
file cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10593 (The WPForms \u2013 Easy Form Builder for WordPress \u2013
Contact Form ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10577 (The \u80d6\u9f20\u91c7\u96c6(Fat Rat Collect)
\u5fae\u4fe1\u77e5\u4e4e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10575 (CWE-862: Missing Authorization vulnerability exists that could
cause u ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2024-10531 (The Kognetiks Chatbot for WordPress plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10530 (The Kognetiks Chatbot for WordPress plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10529 (The Kognetiks Chatbot for WordPress plugin for WordPress is
vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10174 (The WP Project Manager \u2013 Task, team, and project
management plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10038 (The WP-Strava plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-4458 [ksmbd: fix wrong DataOffset validation of create context]
- linux 6.5.3-1
[bookworm] - linux 6.1.52-1
@@ -240,7 +240,7 @@ CVE-2024-52297 (Tolgee is an open-source localization
platform. Tolgee 3.81.1 in
CVE-2024-52296 (libosdp is an implementation of IEC 60839-11-5 OSDP (Open
Supervised D ...)
TODO: check
CVE-2024-52010 (Zoraxy is a general purpose HTTP reverse proxy and forwarding
tool. A ...)
- TODO: check
+ NOT-FOR-US: Zoraxy
CVE-2024-51750 (Element is a Matrix web client built using the Matrix React
SDK. A mal ...)
TODO: check
CVE-2024-51749 (Element is a Matrix web client built using the Matrix React
SDK. Versi ...)
@@ -707,25 +707,25 @@ CVE-2024-11122 (A vulnerability, which was classified as
critical, has been foun
CVE-2024-11121 (A vulnerability classified as critical was found in
\u4e0a\u6d77\u7075 ...)
NOT-FOR-US: Lingdang CRM
CVE-2024-11007 (Command injection in Ivanti Connect Secure before version
22.7R2.1 and ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2024-11006 (Command injection in Ivanti Connect Secure before version
22.7R2.1 and ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2024-11005 (Command injection in Ivanti Connect Secure before version
22.7R2.1 and ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2024-11004 (Reflected XSS in Ivanti Connect Secure before version 22.7R2.1
and Iva ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2024-10971 (Improper access control in the Password History feature in
Devolutions ...)
- TODO: check
+ NOT-FOR-US: Devolutions DVLS
CVE-2024-10945 (A Local Privilege Escalation vulnerability exists in the
affected prod ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2024-10944 (A Remote Code Execution vulnerability exists in the affected
product. ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2024-10943 (An authentication bypass vulnerability exists in the affected
product. ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2024-10923 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2024-10245 (The Relais 2FA plugin for WordPress is vulnerable to
authentication by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10218 (XSS Attack in mar.jar, Monitoring Archive Utility (MAR
Utility),monito ...)
TODO: check
CVE-2024-10217 (XSS Attack in mar.jar, Monitoring Archive Utility (MAR
Utility),monito ...)
@@ -733,13 +733,13 @@ CVE-2024-10217 (XSS Attack in mar.jar, Monitoring Archive
Utility (MAR Utility),
CVE-2023-52268 (The End-User Portal module before 1.0.65 for FreeScout
sometimes allow ...)
TODO: check
CVE-2023-50176 (A session fixation in Fortinet FortiOS version 7.4.0 through
7.4.3 and ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2023-47543 (An authorization bypass through user-controlled key
vulnerability [CWE ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2023-44255 (An exposure of sensitive information to an unauthorized actor
[CWE-200 ...)
- TODO: check
+ NOT-FOR-US: FortiGuard
CVE-2023-32736 (A vulnerability has been identified in SIMATIC S7-PLCSIM V16
(All vers ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2024-49369 (Icinga is a monitoring system which checks the availability of
network ...)
- icinga2 2.14.3-1 (bug #1087384)
NOTE:
https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3/
@@ -863,7 +863,7 @@ CVE-2024-48837 (Dell SmartFabric OS10 Software, version(s)
10.5.6.x, 10.5.5.x, 1
CVE-2024-48322 (UsersController.php in Run.codes 1.5.2 and older has a reset
password ...)
TODO: check
CVE-2024-47799 (Exposure of sensitive system information to an unauthorized
control sp ...)
- TODO: check
+ NOT-FOR-US: Mesh Wi-Fi router RP562B firmware
CVE-2024-47595 (An attacker who gains local membership to sapsys group could
replace l ...)
NOT-FOR-US: SAP
CVE-2024-47593 (SAP NetWeaver Application Server ABAP allows an
unauthenticated attack ...)
@@ -891,7 +891,7 @@ CVE-2024-46963 (The com.superfast.video.downloader (aka
Super Unlimited Video Do
CVE-2024-46962 (The SYQ com.downloader.video.fast (aka Master Video
Downloader) applic ...)
NOT-FOR-US: SYQ com.downloader.video.fast (aka Master Video Downloader)
application
CVE-2024-45827 (Improper neutralization of special elements used in an OS
command ('OS ...)
- TODO: check
+ NOT-FOR-US: Mesh Wi-Fi router RP562B firmware
CVE-2024-45088 (IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored
cross-site ...)
NOT-FOR-US: IBM
CVE-2024-45087 (IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to
cross-si ...)
@@ -933,63 +933,63 @@ CVE-2024-25255 (Sublime Text 4 was discovered to contain
a command injection vul
CVE-2024-25254 (SuperScan v4.1 was discovered to contain a buffer overflow via
the Hos ...)
TODO: check
CVE-2024-25253 (Driver Booster v10.6 was discovered to contain a buffer
overflow via t ...)
- TODO: check
+ NOT-FOR-US: Driver Booster
CVE-2024-23983 (Improper handling of canonical URL-encoding may lead to bypass
not pro ...)
- TODO: check
+ NOT-FOR-US: PingIdentity
CVE-2024-11102 (A vulnerability was found in SourceCodester Hospital
Management System ...)
- TODO: check
+ NOT-FOR-US: SourceCodester Hospital Management System
CVE-2024-11101 (A vulnerability was found in 1000 Projects Beauty Parlour
Management S ...)
- TODO: check
+ NOT-FOR-US: 1000 Projects Beauty Parlour Management System
CVE-2024-11100 (A vulnerability was found in 1000 Projects Beauty Parlour
Management S ...)
- TODO: check
+ NOT-FOR-US: 1000 Projects Beauty Parlour Management System
CVE-2024-11099 (A vulnerability was found in code-projects Job Recruitment 1.0
and cla ...)
- TODO: check
+ NOT-FOR-US: code-projects Job Recruitment
CVE-2024-11097 (A vulnerability has been found in SourceCodester Student
Record Manage ...)
- TODO: check
+ NOT-FOR-US: SourceCodester Student Record Management System
CVE-2024-11096 (A vulnerability, which was classified as critical, was found
in code-p ...)
- TODO: check
+ NOT-FOR-US: code-projects Task Manager
CVE-2024-11078 (A vulnerability has been found in code-projects Job
Recruitment 1.0 an ...)
- TODO: check
+ NOT-FOR-US: code-projects Job Recruitment
CVE-2024-11077 (A vulnerability, which was classified as critical, was found
in code-p ...)
- TODO: check
+ NOT-FOR-US: code-projects Job Recruitment
CVE-2024-11076 (A vulnerability, which was classified as critical, has been
found in c ...)
- TODO: check
+ NOT-FOR-US: code-projects Job Recruitment
CVE-2024-11074 (A vulnerability classified as critical was found in
itsourcecode Tailo ...)
- TODO: check
+ NOT-FOR-US: itsourcecode Tailoring Management System
CVE-2024-11073 (A vulnerability classified as problematic has been found in
SourceCode ...)
- TODO: check
+ NOT-FOR-US: SourceCodester Hospital Management System
CVE-2024-11070 (A vulnerability, which was classified as problematic, has been
found i ...)
- TODO: check
+ NOT-FOR-US: Sanluan PublicCMS
CVE-2024-11068 (The D-Link DSL6740C modem has an Incorrect Use of Privileged
APIs vuln ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2024-11067 (The D-Link DSL6740C modem has a Path Traversal Vulnerability,
allowing ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2024-10917 (In Eclipse OpenJ9 versions up to 0.47, the JNI function
GetStringUTFLe ...)
TODO: check
CVE-2024-10790 (The Admin and Site Enhancements (ASE) plugin for WordPress is
vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10695 (The Futurio Extra plugin for WordPress is vulnerable to
Information Ex ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10694
REJECTED
CVE-2024-10685 (The Contact Form 7 Redirect & Thank You Page plugin for
WordPress is v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10672 (The Multiple Page Generator Plugin \u2013 MPG plugin for
WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10538 (The Happy Addons for Elementor plugin for WordPress is
vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10345 (In Helix Core versions prior to 2024.2, an unauthenticated
remote Deni ...)
- TODO: check
+ NOT-FOR-US: Helix Core
CVE-2024-10344 (In Helix Core versions prior to 2024.2, an unauthenticated
remote Deni ...)
- TODO: check
+ NOT-FOR-US: Helix Core
CVE-2024-10323 (The JetWidgets For Elementor plugin for WordPress is
vulnerable to Sto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-10315 (In Gliffy Online an insecure configuration was discovered in
versions ...)
- TODO: check
+ NOT-FOR-US: Gliffy Online
CVE-2024-10314 (In Helix Core versions prior to 2024.2, an unauthenticated
remote Deni ...)
- TODO: check
+ NOT-FOR-US: Helix Core
CVE-2024-10179 (The Slickstream: Engagement and Conversions plugin for
WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-49395 (In mutt and neomutt, PGP encryption does not use the
--hidden-recipien ...)
- mutt <unfixed>
[bookworm] - mutt <no-dsa> (Minor issue)
@@ -284228,7 +284228,7 @@ CVE-2021-27706 (Buffer Overflow in Tenda G1 and G3
routers with firmware version
CVE-2021-27705 (Buffer Overflow in Tenda G1 and G3 routers with firmware
v15.11.0.17(9 ...)
NOT-FOR-US: Tenda routers
CVE-2021-27704 (Appspace 6.2.4 is affected by Incorrect Access Control via the
Appspac ...)
- TODO: check
+ NOT-FOR-US: Appspace
CVE-2021-27703 (Sercomm Model Etisalat Model S3- AC2100 is affected by Cross
Site Scri ...)
TODO: check
CVE-2021-27702 (Sercomm Router Etisalat Model S3- AC2100 is affected by
Incorrect Acce ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/baee95636e86c0649d2ca887a2178df706095165
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/baee95636e86c0649d2ca887a2178df706095165
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
