Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9290ebc5 by security tracker role at 2023-08-15T20:12:33+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,163 @@
+CVE-2023-4371 (A vulnerability was found in phpRecDB 1.3.1. It has been rated
as prob ...)
+ TODO: check
+CVE-2023-4369 (Insufficient data validation in Systems Extensions in Google
Chrome on ...)
+ TODO: check
+CVE-2023-4368 (Insufficient policy enforcement in Extensions API in Google
Chrome pri ...)
+ TODO: check
+CVE-2023-4367 (Insufficient policy enforcement in Extensions API in Google
Chrome pri ...)
+ TODO: check
+CVE-2023-4366 (Use after free in Extensions in Google Chrome prior to
116.0.5845.96 a ...)
+ TODO: check
+CVE-2023-4365 (Inappropriate implementation in Fullscreen in Google Chrome
prior to 1 ...)
+ TODO: check
+CVE-2023-4364 (Inappropriate implementation in Permission Prompts in Google
Chrome pr ...)
+ TODO: check
+CVE-2023-4363 (Inappropriate implementation in WebShare in Google Chrome on
Android p ...)
+ TODO: check
+CVE-2023-4362 (Heap buffer overflow in Mojom IDL in Google Chrome prior to
116.0.5845 ...)
+ TODO: check
+CVE-2023-4361 (Inappropriate implementation in Autofill in Google Chrome on
Android p ...)
+ TODO: check
+CVE-2023-4360 (Inappropriate implementation in Color in Google Chrome prior to
116.0. ...)
+ TODO: check
+CVE-2023-4359 (Inappropriate implementation in App Launcher in Google Chrome
on iOS p ...)
+ TODO: check
+CVE-2023-4358 (Use after free in DNS in Google Chrome prior to 116.0.5845.96
allowed ...)
+ TODO: check
+CVE-2023-4357 (Insufficient validation of untrusted input in XML in Google
Chrome pri ...)
+ TODO: check
+CVE-2023-4356 (Use after free in Audio in Google Chrome prior to 116.0.5845.96
allowe ...)
+ TODO: check
+CVE-2023-4355 (Out of bounds memory access in V8 in Google Chrome prior to
116.0.5845 ...)
+ TODO: check
+CVE-2023-4354 (Heap buffer overflow in Skia in Google Chrome prior to
116.0.5845.96 a ...)
+ TODO: check
+CVE-2023-4353 (Heap buffer overflow in ANGLE in Google Chrome prior to
116.0.5845.96 ...)
+ TODO: check
+CVE-2023-4352 (Type confusion in V8 in Google Chrome prior to 116.0.5845.96
allowed a ...)
+ TODO: check
+CVE-2023-4351 (Use after free in Network in Google Chrome prior to
116.0.5845.96 allo ...)
+ TODO: check
+CVE-2023-4350 (Inappropriate implementation in Fullscreen in Google Chrome on
Android ...)
+ TODO: check
+CVE-2023-4349 (Use after free in Device Trust Connectors in Google Chrome
prior to 11 ...)
+ TODO: check
+CVE-2023-4345 (Broadcom RAID Controller web interface is vulnerable
client-side contr ...)
+ TODO: check
+CVE-2023-4344 (Broadcom RAID Controller web interface is vulnerable to
insufficient r ...)
+ TODO: check
+CVE-2023-4343 (Broadcom RAID Controller web interface is vulnerable due to
exposure o ...)
+ TODO: check
+CVE-2023-4342 (Broadcom RAID Controller web interface is vulnerable due to
insecure d ...)
+ TODO: check
+CVE-2023-4341 (Broadcom RAID Controller is vulnerable to Privilege escalation
to root ...)
+ TODO: check
+CVE-2023-4340 (Broadcom RAID Controller is vulnerable to Privilege escalation
by taki ...)
+ TODO: check
+CVE-2023-4339 (Broadcom RAID Controller web interface is vulnerable to
exposure of pr ...)
+ TODO: check
+CVE-2023-4338 (Broadcom RAID Controller web interface is vulnerable due to
insecure d ...)
+ TODO: check
+CVE-2023-4337 (Broadcom RAID Controller web interface is vulnerable to
improper sessi ...)
+ TODO: check
+CVE-2023-4336 (Broadcom RAID Controller web interface is vulnerable due to
insecure d ...)
+ TODO: check
+CVE-2023-4335 (Broadcom RAID Controller Web server (nginx) is serving private
server- ...)
+ TODO: check
+CVE-2023-4334 (Broadcom RAID Controller Web server (nginx) is serving private
files w ...)
+ TODO: check
+CVE-2023-4333 (Broadcom RAID Controller web interface is vulnerable to
exposure of s ...)
+ TODO: check
+CVE-2023-4332 (Broadcom RAID Controller web interface is vulnerable due to
Improper p ...)
+ TODO: check
+CVE-2023-4331 (Broadcom RAID Controller web interface is vulnerable has an
insecure d ...)
+ TODO: check
+CVE-2023-4330 (Broadcom RAID Controller web interface is vulnerable Denial of
Service ...)
+ TODO: check
+CVE-2023-4329 (Broadcom RAID Controller web interface is vulnerable due to
insecure d ...)
+ TODO: check
+CVE-2023-4328 (Broadcom RAID Controller web interface is vulnerable to
exposure of s ...)
+ TODO: check
+CVE-2023-4327 (Broadcom RAID Controller web interface is vulnerable to
exposure of se ...)
+ TODO: check
+CVE-2023-4326 (Broadcom RAID Controller web interface is vulnerable has an
insecure d ...)
+ TODO: check
+CVE-2023-4325 (Broadcom RAID Controller web interface is vulnerable due to
usage of L ...)
+ TODO: check
+CVE-2023-4324 (Broadcom RAID Controller web interface is vulnerable due to
insecure d ...)
+ TODO: check
+CVE-2023-4323 (Broadcom RAID Controller web interface is vulnerable to
improper sessi ...)
+ TODO: check
+CVE-2023-40028 (Ghost is an open source content management system. Versions
prior to 5 ...)
+ TODO: check
+CVE-2023-40027 (Keystone is an open source headless CMS for Node.js \u2014
built with ...)
+ TODO: check
+CVE-2023-39843 (Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door
Lock v1 ...)
+ TODO: check
+CVE-2023-39842 (Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home
Securit ...)
+ TODO: check
+CVE-2023-39841 (Missing encryption in the RFID tag of Etekcity 3-in-1 Smart
Door Lock ...)
+ TODO: check
+CVE-2023-39662 (An issue in llama_index v.0.7.13 and before allows a remote
attacker t ...)
+ TODO: check
+CVE-2023-39661 (An issue in pandas-ai v.0.9.1 and before allows a remote
attacker to e ...)
+ TODO: check
+CVE-2023-39659 (An issue in langchain langchain-ai v.0.0.232 and before allows
a remot ...)
+ TODO: check
+CVE-2023-39438 (A missing authorization check allows an arbitrary
authenticated user t ...)
+ TODO: check
+CVE-2023-38916 (SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows
a remote ...)
+ TODO: check
+CVE-2023-38915 (File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows
a remote ...)
+ TODO: check
+CVE-2023-38898 (An issue in Python cpython v.3.7 allows an attacker to obtain
sensitiv ...)
+ TODO: check
+CVE-2023-38896 (An issue in Harrison Chase langchain v.0.0.194 and before
allows a rem ...)
+ TODO: check
+CVE-2023-38889 (An issue in Alluxio v.2.9.3 and before allows an attacker to
execute a ...)
+ TODO: check
+CVE-2023-38866 (COMFAST CF-XR11 V2.7.2 has a command injection vulnerability
detected ...)
+ TODO: check
+CVE-2023-38865 (COMFAST CF-XR11 V2.7.2 has a command injection vulnerability
detected ...)
+ TODO: check
+CVE-2023-38864 (An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to
execute arbi ...)
+ TODO: check
+CVE-2023-38863 (An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to
execute arbi ...)
+ TODO: check
+CVE-2023-38862 (An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to
execute arbi ...)
+ TODO: check
+CVE-2023-38861 (An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a
remote a ...)
+ TODO: check
+CVE-2023-38860 (An issue in LangChain v.0.0.231 allows a remote attacker to
execute ar ...)
+ TODO: check
+CVE-2023-38858 (Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38857 (Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38856 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38855 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38854 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38853 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38852 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38851 (Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote
attacke ...)
+ TODO: check
+CVE-2023-38850 (Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7
allows an ...)
+ TODO: check
+CVE-2023-38840 (An issue in Bitwarden Bitwarden Desktop v.2023.5.1 allows a
local atta ...)
+ TODO: check
+CVE-2023-38402 (A vulnerability in the HPE Aruba Networking Virtual
IntranetAccess (VI ...)
+ TODO: check
+CVE-2023-38401 (A vulnerability in the HPE Aruba Networking Virtual Intranet
Access (V ...)
+ TODO: check
+CVE-2023-35082 (An authentication bypass vulnerability in Ivanti EPMM 11.10
and older, ...)
+ TODO: check
+CVE-2023-2916 (The InfiniteWP Client plugin for WordPress is vulnerable to
Sensitive ...)
+ TODO: check
CVE-2023-4347 (Cross-site Scripting (XSS) - Reflected in GitHub repository
librenms/l ...)
NOT-FOR-US: LibreNMS
CVE-2023-4308 (The User Submitted Posts plugin for WordPress is vulnerable to
Stored ...)
@@ -557,7 +717,7 @@ CVE-2023-32559
CVE-2023-32558
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#processbinding-can-bypass-the-permission-model-through-path-traversal-highcve-2023-32558
-CVE-2023-32006
+CVE-2023-32006 (The use of `module.constructor.createRequire()` can bypass the
policy ...)
- nodejs <unfixed>
[buster] - nodejs <not-affected> (v10.x doesn't support policy
manifests)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006
@@ -566,10 +726,10 @@ CVE-2023-32006
CVE-2023-32005
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#fsstatfs-can-retrive-stats-from-files-restricted-by-the-permission-model-lowcve-2023-32005
-CVE-2023-32004
+CVE-2023-32004 (A vulnerability has been discovered in Node.js version 20,
specificall ...)
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permission-model-bypass-by-specifying-a-path-traversal-sequence-in-a-buffer-highcve-2023-32004
-CVE-2023-32003
+CVE-2023-32003 (`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass
the permis ...)
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#fsmkdtemp-and-fsmkdtempsync-are-missing-getvalidatedpath-checks-lowcve-2023-32003
CVE-2023-32002
@@ -2150,6 +2310,7 @@ CVE-2023-3997 (Splunk SOAR versions 6.0.2 and earlier are
indirectly affected by
CVE-2023-3983 (An authenticated SQL injection vulnerability exists in
Advantech iView ...)
NOT-FOR-US: Advantech iView
CVE-2023-3817 (Issue summary: Checking excessively long DH keys or parameters
may be ...)
+ {DLA-3530-1}
- openssl 3.0.10-1
[bookworm] - openssl <postponed> (Minor issue, fix along with future
DSA)
[bullseye] - openssl <postponed> (Minor issue, fix along with future
DSA)
@@ -3373,6 +3534,7 @@ CVE-2023-3745 (A heap-based buffer overflow issue was
found in ImageMagick's Pus
NOTE:
https://github.com/ImageMagick/ImageMagick6/commit/7486477aa00c5c7856b111506da075b6cdfa8b73
(6.9.11-0)
NOTE:
https://github.com/ImageMagick/ImageMagick6/commit/b466a96965afc1308a4ace93f5535c2b770f294b
(6.9.11-0)
CVE-2023-3446 (Issue summary: Checking excessively long DH keys or parameters
may be ...)
+ {DLA-3530-1}
- openssl 3.0.10-1 (bug #1041817)
[bookworm] - openssl <postponed> (Minor issue, fix along with future
DSA)
[bullseye] - openssl <postponed> (Minor issue, fix along with future
DSA)
@@ -12053,8 +12215,8 @@ CVE-2023-2313 (Inappropriate implementation in Sandbox
in Google Chrome on Windo
{DSA-5386-1}
- chromium 112.0.5615.49-1
[buster] - chromium <end-of-life> (see DSA 5046)
-CVE-2023-2312
- RESERVED
+CVE-2023-2312 (Use after free in Offline in Google Chrome on Android prior to
116.0.5 ...)
+ TODO: check
CVE-2023-2311 (Insufficient policy enforcement in File System API in Google
Chrome pr ...)
{DSA-5386-1}
- chromium 112.0.5615.49-1
@@ -13485,8 +13647,8 @@ CVE-2023-30780 (Auth. (contributor+) Stored Cross-Site
Scripting (XSS) vulnerabi
NOT-FOR-US: WordPress plugin
CVE-2023-30779
RESERVED
-CVE-2023-30778
- RESERVED
+CVE-2023-30778 (Auth. (contributor+) Stored Cross-Site Scripting (XSS)
vulnerability i ...)
+ TODO: check
CVE-2023-30777 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
WP Engin ...)
NOT-FOR-US: WordPress plugin
CVE-2023-30776 (An authenticated user with specific data permissions could
access data ...)
@@ -13680,8 +13842,8 @@ CVE-2023-30749 (Auth. (admin+) Stored Cross-Site
Scripting (XSS) vulnerability i
NOT-FOR-US: WordPress plugin
CVE-2023-30748
RESERVED
-CVE-2023-30747
- RESERVED
+CVE-2023-30747 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
WPGem Wo ...)
+ TODO: check
CVE-2023-30746 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Booq ...)
NOT-FOR-US: WordPress plugin
CVE-2023-30745 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Phan ...)
@@ -14576,8 +14738,8 @@ CVE-2023-30500 (Unauth. Reflected Cross-Site Scripting
(XSS) vulnerability in WP
NOT-FOR-US: WordPress plugin
CVE-2023-30499
RESERVED
-CVE-2023-30498
- RESERVED
+CVE-2023-30498 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
CodeFlav ...)
+ TODO: check
CVE-2023-30497
RESERVED
CVE-2023-30496
@@ -20651,8 +20813,8 @@ CVE-2023-28481 (An issue was discovered in Tigergraph
Enterprise 3.7.0. There is
TODO: check
CVE-2023-28480 (An issue was discovered in Tigergraph Enterprise 3.7.0. The
TigerGraph ...)
TODO: check
-CVE-2023-28479
- RESERVED
+CVE-2023-28479 (An issue was discovered in Tigergraph Enterprise 3.7.0. The
TigerGraph ...)
+ TODO: check
CVE-2023-28478 (TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498
have a Bu ...)
NOT-FOR-US: TP-Link
CVE-2023-28477 (Concrete CMS (previously concrete5) before 9.2 is vulnerable
to stored ...)
@@ -23295,7 +23457,7 @@ CVE-2023-27708
RESERVED
CVE-2023-27707 (SQL injection vulnerability found in DedeCMS v.5.7.106 allows
a remote ...)
NOT-FOR-US: DedeCMS
-CVE-2023-27706 (Bitwarden Desktop v1.20.0 and above stores the biometric key
in plaint ...)
+CVE-2023-27706 (Bitwarden Windows desktop application versions prior to
v2023.4.0 stor ...)
NOT-FOR-US: Bitwarden
CVE-2023-27705 (APNG_Optimizer v1.4 was discovered to contain a buffer
overflow via th ...)
NOT-FOR-US: APNG Optimizer
@@ -24182,8 +24344,8 @@ CVE-2023-26591
RESERVED
CVE-2023-25080
RESERVED
-CVE-2023-24478
- RESERVED
+CVE-2023-24478 (Use of insufficiently random values for some Intel Agilex(R)
software ...)
+ TODO: check
CVE-2023-24463
RESERVED
CVE-2023-22312 (Improper access control for some Intel(R) NUC BIOS firmware
may allow ...)
@@ -183540,6 +183702,7 @@ CVE-2021-23447 (This affects the package teddy before
0.5.9. A type confusion vu
CVE-2021-23446 (The package handsontable before 10.0.0; the package
handsontable from ...)
NOT-FOR-US: Node handsontable
CVE-2021-23445 (This affects the package datatables.net before 1.11.3. If an
array is ...)
+ {DLA-3529-1}
- datatables.js 1.10.21+dfsg-3 (bug #995229)
[bullseye] - datatables.js 1.10.21+dfsg-2+deb11u1
[stretch] - datatables.js <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9290ebc57031e9c1c9881d8b56606e463f8bb2aa
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9290ebc57031e9c1c9881d8b56606e463f8bb2aa
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
