Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 01a988a6 by security tracker role at 2025-02-12T20:17:47+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,31 +1,287 @@ -CVE-2025-21699 [gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag] +CVE-2025-26378 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q- ...) + TODO: check +CVE-2025-26377 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q- ...) + TODO: check +CVE-2025-26376 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q- ...) + TODO: check +CVE-2025-26375 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q- ...) + TODO: check +CVE-2025-26374 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user ...) + TODO: check +CVE-2025-26373 (A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user ...) + TODO: check +CVE-2025-26372 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26371 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26370 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26369 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26368 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26367 (A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua ...) + TODO: check +CVE-2025-26366 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26365 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26364 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26363 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26362 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26361 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26360 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26359 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26358 (A CWE-20 "Improper Input Validation" in ldbMT.so in Q-Free MaxTime les ...) + TODO: check +CVE-2025-26357 (A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Fr ...) + TODO: check +CVE-2025-26356 (A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setAct ...) + TODO: check +CVE-2025-26355 (A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Fr ...) + TODO: check +CVE-2025-26354 (A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy e ...) + TODO: check +CVE-2025-26353 (A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime ...) + TODO: check +CVE-2025-26352 (A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free ...) + TODO: check +CVE-2025-26351 (A CWE-35 "Path Traversal" in the template download mechanism in Q-Free ...) + TODO: check +CVE-2025-26350 (A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the tem ...) + TODO: check +CVE-2025-26349 (A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-F ...) + TODO: check +CVE-2025-26348 (A CWE-89 "Improper Neutralization of Special Elements used in an SQL C ...) + TODO: check +CVE-2025-26347 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26346 (A CWE-89 "Improper Neutralization of Special Elements used in an SQL C ...) + TODO: check +CVE-2025-26345 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26344 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26343 (A CWE-1390 "Weak Authentication" in the PIN authentication mechanism i ...) + TODO: check +CVE-2025-26342 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26341 (A CWE-306 "Missing Authentication for Critical Function" in maxprofile ...) + TODO: check +CVE-2025-26340 (A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in ...) + TODO: check +CVE-2025-26339 (A CWE-306 "Missing Authentication for Critical Function" in maxtime/ha ...) + TODO: check +CVE-2025-25746 (D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based bu ...) + TODO: check +CVE-2025-25744 (D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based bu ...) + TODO: check +CVE-2025-25743 (D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command inject ...) + TODO: check +CVE-2025-25742 (D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based bu ...) + TODO: check +CVE-2025-25741 (D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based bu ...) + TODO: check +CVE-2025-25351 (PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Inje ...) + TODO: check +CVE-2025-25349 (PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Inje ...) + TODO: check +CVE-2025-25343 (Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in ...) + TODO: check +CVE-2025-25283 (parse-duraton is software that allows users to convert a human readabl ...) + TODO: check +CVE-2025-25205 (Audiobookshelf is a self-hosted audiobook and podcast server. Starting ...) + TODO: check +CVE-2025-25201 (Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For re ...) + TODO: check +CVE-2025-25200 (Koa is expressive middleware for Node.js using ES2017 async functions. ...) + TODO: check +CVE-2025-25199 (go-crypto-winnative Go crypto backend for Windows using Cryptography A ...) + TODO: check +CVE-2025-25198 (mailcow: dockerized is an open source groupware/email suite based on d ...) + TODO: check +CVE-2025-25184 (Rack provides an interface for developing web applications in Ruby. Pr ...) + TODO: check +CVE-2025-25182 (Stroom is a data processing, storage and analysis platform. A vulnerab ...) + TODO: check +CVE-2025-1244 (A flaw was found in the Emacs text editor. Improper handling of custom ...) + TODO: check +CVE-2025-1230 (Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, d ...) + TODO: check +CVE-2025-1225 (A vulnerability, which was classified as problematic, has been found i ...) + TODO: check +CVE-2025-1224 (A vulnerability classified as critical was found in ywoa up to 2024.07 ...) + TODO: check +CVE-2025-1216 (A vulnerability, which was classified as critical, has been found in y ...) + TODO: check +CVE-2025-1215 (A vulnerability classified as problematic was found in vim up to 9.1.1 ...) + TODO: check +CVE-2025-1214 (A vulnerability classified as critical has been found in pihome-shc Pi ...) + TODO: check +CVE-2025-1213 (A vulnerability was found in pihome-shc PiHome 1.77. It has been rated ...) + TODO: check +CVE-2025-1212 (An information disclosure vulnerability in GitLab CE/EE affecting all ...) + TODO: check +CVE-2025-1210 (A vulnerability classified as critical was found in code-projects Wazi ...) + TODO: check +CVE-2025-1209 (A vulnerability classified as problematic has been found in code-proje ...) + TODO: check +CVE-2025-1208 (A vulnerability was found in code-projects Wazifa System 1.0. It has b ...) + TODO: check +CVE-2025-1207 (A vulnerability was found in phjounin TFTPD64 4.64. It has been declar ...) + TODO: check +CVE-2025-1206 (A vulnerability was found in Codezips Gym Management System 1.0. It ha ...) + TODO: check +CVE-2025-1202 (A vulnerability classified as critical has been found in SourceCodeste ...) + TODO: check +CVE-2025-1201 (A vulnerability was found in SourceCodester Best Church Management Sof ...) + TODO: check +CVE-2025-1200 (A vulnerability was found in SourceCodester Best Church Management Sof ...) + TODO: check +CVE-2025-1199 (A vulnerability was found in SourceCodester Best Church Management Sof ...) + TODO: check +CVE-2025-1197 (A vulnerability has been found in code-projects Real Estate Property M ...) + TODO: check +CVE-2025-1196 (A vulnerability, which was classified as problematic, was found in cod ...) + TODO: check +CVE-2025-1195 (A vulnerability, which was classified as problematic, has been found i ...) + TODO: check +CVE-2025-1192 (A vulnerability was found in SourceCodester Multi Restaurant Table Res ...) + TODO: check +CVE-2025-1191 (A vulnerability was found in SourceCodester Multi Restaurant Table Res ...) + TODO: check +CVE-2025-1190 (A vulnerability has been found in code-projects Job Recruitment 1.0 an ...) + TODO: check +CVE-2025-1189 (A vulnerability, which was classified as critical, was found in 1000 P ...) + TODO: check +CVE-2025-1188 (A vulnerability, which was classified as critical, has been found in C ...) + TODO: check +CVE-2025-1187 (A vulnerability classified as critical was found in code-projects Poli ...) + TODO: check +CVE-2025-1146 (CrowdStrike uses industry-standard TLS (transport layer security) to s ...) + TODO: check +CVE-2025-1102 (A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Fre ...) + TODO: check +CVE-2025-1101 (A CWE-204 "Observable Response Discrepancy" in the login page in Q-Fre ...) + TODO: check +CVE-2025-1100 (A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free ...) + TODO: check +CVE-2025-1042 (An insecure direct object reference vulnerability in GitLab EE affecti ...) + TODO: check +CVE-2025-0937 (Nomad Community and Nomad Enterprise ("Nomad") event stream configured ...) + TODO: check +CVE-2025-0925 + REJECTED +CVE-2025-0919 + REJECTED +CVE-2025-0556 (In Progress\xae Telerik\xae Report Server, versions prior to 2025 Q1 ( ...) + TODO: check +CVE-2025-0516 (Improper Authorization in GitLab CE/EE affecting all versions from 17. ...) + TODO: check +CVE-2025-0511 (The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cr ...) + TODO: check +CVE-2025-0506 (The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for Wo ...) + TODO: check +CVE-2025-0376 (An XSS vulnerability exists in GitLab CE/EE affecting all versions fro ...) + TODO: check +CVE-2025-0332 (In Progress\xae Telerik\xae UI for WinForms, versions prior to 2025 Q1 ...) + TODO: check +CVE-2024-9870 (An external service interaction vulnerability in GitLab EE affecting a ...) + TODO: check +CVE-2024-6097 (In Progress\xae Telerik\xae Reporting versions prior to 2025 Q1 (19.0. ...) + TODO: check +CVE-2024-54160 (dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as ship ...) + TODO: check +CVE-2024-32838 (SQL Injection vulnerability in various API endpoints - offices, dashbo ...) + TODO: check +CVE-2024-23563 (HCL Connections Docs is vulnerable to a sensitive information disclosu ...) + TODO: check +CVE-2024-13814 (The The Global Gallery - WordPress Responsive Gallery plugin for WordP ...) + TODO: check +CVE-2024-13532 (The Small Package Quotes \u2013 Purolator Edition plugin for WordPress ...) + TODO: check +CVE-2024-13531 (The ShipEngine Shipping Quotes plugin for WordPress is vulnerable to S ...) + TODO: check +CVE-2024-13528 (The Customer Email Verification for WooCommerce plugin for WordPress i ...) + TODO: check +CVE-2024-13490 (The LTL Freight Quotes \u2013 XPO Edition plugin for WordPress is vuln ...) + TODO: check +CVE-2024-13480 (The LTL Freight Quotes \u2013 For Customers of FedEx Freight plugin fo ...) + TODO: check +CVE-2024-13477 (The LTL Freight Quotes \u2013 Unishippers Edition plugin for WordPress ...) + TODO: check +CVE-2024-13475 (The Small Package Quotes \u2013 UPS Edition plugin for WordPress is vu ...) + TODO: check +CVE-2024-13473 (The LTL Freight Quotes \u2013 Worldwide Express Edition plugin for Wor ...) + TODO: check +CVE-2024-13459 (The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site S ...) + TODO: check +CVE-2024-13456 (The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross ...) + TODO: check +CVE-2024-13437 (The Book a Room plugin for WordPress is vulnerable to Cross-Site Reque ...) + TODO: check +CVE-2024-13435 (The Ebook Downloader plugin for WordPress is vulnerable to SQL Injecti ...) + TODO: check +CVE-2024-13365 (The Security & Malware scan by CleanTalk plugin for WordPress is vulne ...) + TODO: check +CVE-2024-12629 (In Progress\xae Telerik\xae KendoReact versions v3.5.0 through v9.4.0, ...) + TODO: check +CVE-2024-12386 (The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Requ ...) + TODO: check +CVE-2024-12379 (A denial of service vulnerability in GitLab CE/EE affecting all versio ...) + TODO: check +CVE-2024-12315 (The Export All Posts, Products, Orders, Refunds & Users plugin for Wor ...) + TODO: check +CVE-2024-12296 (The Apus Framework plugin for WordPress is vulnerable to unauthorized ...) + TODO: check +CVE-2024-12251 (In Progress\xae Telerik\xae UI for WinUI versions prior to 2025 Q1 (3. ...) + TODO: check +CVE-2024-12213 (The WP Job Board Pro plugin for WordPress is vulnerable to privilege e ...) + TODO: check +CVE-2024-11629 (In Progress\xae Telerik\xae Document Processing Libraries, versions pr ...) + TODO: check +CVE-2024-11628 (In Progress\xae Telerik\xae Kendo UI for Vue versions v2.4.0 through v ...) + TODO: check +CVE-2024-11343 (In Progress\xae Telerik\xae Document Processing Libraries, versions pr ...) + TODO: check +CVE-2024-10960 (The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to ar ...) + TODO: check +CVE-2024-10322 (The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to St ...) + TODO: check +CVE-2025-21699 (In the Linux kernel, the following vulnerability has been resolved: g ...) - linux 6.12.12-1 [bookworm] - linux 6.1.128-1 NOTE: https://git.kernel.org/linus/7c9d9223802fbed4dee1ae301661bf346964c9d2 (6.14-rc1) -CVE-2025-21698 [Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"] +CVE-2025-21698 (In the Linux kernel, the following vulnerability has been resolved: R ...) - linux 6.12.12-1 [bookworm] - linux 6.1.128-1 NOTE: https://git.kernel.org/linus/086fd062bc3883ae1ce4166cff5355db315ad879 (6.14-rc1) -CVE-2024-57952 [Revert "libfs: fix infinite directory reads for offset dir"] +CVE-2024-57952 (In the Linux kernel, the following vulnerability has been resolved: R ...) - linux 6.12.12-1 NOTE: https://git.kernel.org/linus/b662d858131da9a8a14e68661656989b14dbf113 (6.14-rc1) -CVE-2025-21697 [drm/v3d: Ensure job pointer is set to NULL after job completion] +CVE-2025-21697 (In the Linux kernel, the following vulnerability has been resolved: d ...) - linux 6.12.11-1 [bookworm] - linux 6.1.128-1 NOTE: https://git.kernel.org/linus/e4b5ccd392b92300a2b341705cc4805681094e49 (6.13) -CVE-2025-21696 [mm: clear uffd-wp PTE/PMD state on mremap()] +CVE-2025-21696 (In the Linux kernel, the following vulnerability has been resolved: m ...) - linux 6.12.11-1 NOTE: https://git.kernel.org/linus/0cef0bb836e3cfe00f08f9606c72abd72fe78ca3 (6.13) -CVE-2025-21695 [platform/x86: dell-uart-backlight: fix serdev race] +CVE-2025-21695 (In the Linux kernel, the following vulnerability has been resolved: p ...) - linux 6.12.11-1 [bookworm] - linux <not-affected> (Vulnerable code not present) [bullseye] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/1b2128aa2d45ab20b22548dcf4b48906298ca7fd (6.13) -CVE-2025-21694 [fs/proc: fix softlockup in __read_vmcore (part 2)] +CVE-2025-21694 (In the Linux kernel, the following vulnerability has been resolved: f ...) - linux 6.12.11-1 [bookworm] - linux 6.1.128-1 NOTE: https://git.kernel.org/linus/cbc5dde0a461240046e8a41c43d7c3b76d5db952 (6.13) -CVE-2024-57951 [hrtimers: Handle CPU state correctly on hotplug] +CVE-2024-57951 (In the Linux kernel, the following vulnerability has been resolved: h ...) - linux 6.12.11-1 [bookworm] - linux 6.1.128-1 NOTE: https://git.kernel.org/linus/2f8dea1692eef2b7ba6a256246ed82c365fdc686 (6.13) @@ -1389,6 +1645,7 @@ CVE-2024-35106 (NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buff CVE-2024-10383 (An issue has been discovered in the gitlab-web-ide-vscode-fork compone ...) TODO: check CVE-2025-24032 (PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificat ...) + {DSA-5864-1} - pam-pkcs11 0.6.13-1 NOTE: https://github.com/OpenSC/pam_pkcs11/commit/b665b287ff955bbbd9539252ff9f9e2754c3fb48 (pam_pkcs11-0.6.13) NOTE: https://github.com/OpenSC/pam_pkcs11/commit/d9530167966a77115db6e885d459382a2e52ee9e (pam_pkcs11-0.6.13) @@ -1482,6 +1739,7 @@ CVE-2024-12133 (A flaw in libtasn1 causes inefficient handling of specific certi NOTE: https://gitlab.com/gnutls/libtasn1/-/commit/869a97aa259dffa2620dabcad84e1c22545ffc3d (v4.20.0) NOTE: https://lists.gnu.org/archive/html/help-libtasn1/2025-02/msg00001.html CVE-2025-24531 [Possible Authentication Bypass in Error Situations] + {DSA-5864-1} - pam-pkcs11 0.6.13-1 (bug #1095402) [bullseye] - pam-pkcs11 <not-affected> (Vulnerable code not present) NOTE: https://www.openwall.com/lists/oss-security/2025/02/06/3 @@ -3665,7 +3923,7 @@ CVE-2024-23953 (Use of Arrays.equals() in LlapSignerImpl inApache Hive to compar NOT-FOR-US: Apache Hive CVE-2024-13527 (The Philantro \u2013 Donations and Donor Management plugin for WordPre ...) NOT-FOR-US: WordPress plugin -CVE-2024-13484 (A flaw was found in ArgoCD. The openshift.io/cluster-monitoring label ...) +CVE-2024-13484 (A flaw was found in openshift-gitops-operator-container. The openshift ...) NOT-FOR-US: ArgoCD CVE-2024-11956 (A vulnerability, which was classified as critical, has been found in P ...) NOT-FOR-US: Pimcore customer-data-framework @@ -3688,6 +3946,7 @@ CVE-2025-24166 CVE-2025-24163 (The issue was addressed with improved checks. This issue is fixed in i ...) NOT-FOR-US: Apple CVE-2025-24162 (This issue was addressed through improved state management. This issue ...) + {DSA-5865-1} - webkit2gtk 2.46.6-1 - wpewebkit 2.46.6-1 [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) @@ -3700,6 +3959,7 @@ CVE-2025-24160 (The issue was addressed with improved checks. This issue is fixe CVE-2025-24159 (A validation issue was addressed with improved logic. This issue is fi ...) NOT-FOR-US: Apple CVE-2025-24158 (The issue was addressed with improved memory handling. This issue is f ...) + {DSA-5865-1} - webkit2gtk 2.46.6-1 - wpewebkit 2.46.6-1 [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) @@ -3716,6 +3976,7 @@ CVE-2025-24152 (The issue was addressed with improved memory handling. This issu CVE-2025-24151 (The issue was addressed with improved memory handling. This issue is f ...) NOT-FOR-US: Apple CVE-2025-24150 (A privacy issue was addressed with improved handling of files. This is ...) + {DSA-5865-1} - webkit2gtk 2.46.6-1 - wpewebkit 2.46.6-1 [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) @@ -3728,6 +3989,7 @@ CVE-2025-24146 (This issue was addressed with improved redaction of sensitive in CVE-2025-24145 (A privacy issue was addressed with improved private data redaction for ...) NOT-FOR-US: Apple CVE-2025-24143 (The issue was addressed with improved access restrictions to the file ...) + {DSA-5865-1} - webkit2gtk 2.46.6-1 - wpewebkit 2.46.6-1 [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) @@ -3859,7 +4121,7 @@ CVE-2024-54549 (This issue was addressed with improved redaction of sensitive in CVE-2024-54547 (The issue was addressed with improved checks. This issue is fixed in m ...) NOT-FOR-US: Apple CVE-2024-54543 (The issue was addressed with improved memory handling. This issue is f ...) - {DSA-5835-1} + {DSA-5835-1 DLA-4009-1} - webkit2gtk 2.46.5-1 - wpewebkit 2.46.5-1 [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/01a988a66867921e7db64b66f73cfacac00b8dcb -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/01a988a66867921e7db64b66f73cfacac00b8dcb You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits