Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a24d6317 by security tracker role at 2020-08-05T20:10:25+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,29 @@
+CVE-2020-17364 (USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN
logs. ...)
+ TODO: check
+CVE-2020-17363
+ RESERVED
+CVE-2020-17362
+ RESERVED
+CVE-2020-17361
+ RESERVED
+CVE-2020-17360
+ RESERVED
+CVE-2020-17359
+ RESERVED
+CVE-2020-17358
+ RESERVED
+CVE-2020-17357
+ RESERVED
+CVE-2020-17356
+ RESERVED
+CVE-2020-17355
+ RESERVED
+CVE-2020-17354
+ RESERVED
+CVE-2020-17353 (scm/define-stencil-commands.scm in LilyPond through 2.20.0,
and 2.21.x ...)
+ TODO: check
+CVE-2020-17352
+ RESERVED
CVE-2020-17351
RESERVED
CVE-2020-17350
@@ -2197,10 +2223,10 @@ CVE-2020-16255
RESERVED
CVE-2020-16254
RESERVED
-CVE-2020-16253
- RESERVED
-CVE-2020-16252
- RESERVED
+CVE-2020-16253 (The PgHero gem through 2.6.0 for Ruby allows CSRF. ...)
+ TODO: check
+CVE-2020-16252 (The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
...)
+ TODO: check
CVE-2020-16251
RESERVED
CVE-2020-16250
@@ -2319,8 +2345,8 @@ CVE-2020-16194
RESERVED
CVE-2020-16193
RESERVED
-CVE-2020-16192
- RESERVED
+CVE-2020-16192 (LimeSurvey 4.3.2 allows reflected XSS because
application/controllers/ ...)
+ TODO: check
CVE-2020-16191
RESERVED
CVE-2020-16190
@@ -4868,8 +4894,8 @@ CVE-2020-15108 (In glpi before 9.5.1, there is a SQL
injection for all usages of
NOTE: Only supported behind an authenticated HTTP zone
CVE-2020-15107 (In openenclave before 0.10.0, enclaves that use x87 FPU
operations are ...)
NOT-FOR-US: openenclave
-CVE-2020-15106
- RESERVED
+CVE-2020-15106 (In etcd before versions 3.3.23 and 3.4.10, a large slice
causes panic ...)
+ TODO: check
CVE-2020-15105 (Django Two-Factor Authentication before 1.12, stores the
user's passwo ...)
NOT-FOR-US: Django Two-Factor Authentication
CVE-2020-15104 (In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0
when valid ...)
@@ -6847,8 +6873,7 @@ CVE-2020-14349
CVE-2020-14348
RESERVED
NOT-FOR-US: AMQ Online
-CVE-2020-14347 [X Server Pixel Data Uninitialized Memory Information
Disclosure]
- RESERVED
+CVE-2020-14347 (A flaw was found in the way xserver memory was not properly
initialize ...)
- xorg-server <unfixed>
[stretch] - xorg-server <postponed> (Minor issue, can be fixed along in
next release)
NOTE: https://lists.x.org/archives/xorg-announce/2020-July/003051.html
@@ -6857,8 +6882,7 @@ CVE-2020-14346
RESERVED
CVE-2020-14345
RESERVED
-CVE-2020-14344 [Heap corruption in the X input method client in libX11]
- RESERVED
+CVE-2020-14344 (An integer overflow leading to a heap-buffer overflow was
found in The ...)
{DLA-2312-1}
- libx11 2:1.6.10-1
[buster] - libx11 <no-dsa> (Minor issue)
@@ -7987,8 +8011,8 @@ CVE-2020-13923 (IDOR vulnerability in the order
processing feature from ecommerc
NOT-FOR-US: Apache OFBiz
CVE-2020-13922
RESERVED
-CVE-2020-13921
- RESERVED
+CVE-2020-13921 (**Resolved** Only when using H2/MySQL/TiDB as Apache
SkyWalking storag ...)
+ TODO: check
CVE-2020-13920
RESERVED
CVE-2020-13919 (emfd/libemf in Ruckus Wireless Unleashed through
200.7.10.102.92 allow ...)
@@ -8241,8 +8265,8 @@ CVE-2020-13821
RESERVED
CVE-2020-13820 (Extreme Management Center 8.4.1.24 allows unauthenticated
reflected XS ...)
NOT-FOR-US: Extreme Management Center
-CVE-2020-13819
- RESERVED
+CVE-2020-13819 (Extreme EAC Appliance 8.4.1.24 allows unauthenticated
reflected XSS vi ...)
+ TODO: check
CVE-2020-13818 (In Zoho ManageEngine OpManager before 125144, when
<cachestart> ...)
NOT-FOR-US: Zoho ManageEngine OpManager
CVE-2020-13817 (ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows
remote att ...)
@@ -9891,8 +9915,8 @@ CVE-2020-13153 (app/View/Events/resolved_attributes.ctp
in MISP before 2.4.126 h
CVE-2020-13152 (A remote user can create a specially crafted M3U file, media
playlist ...)
- amarok <removed> (unimportant)
NOTE: Elevated resource usage in client application, no security impact
-CVE-2020-13151
- RESERVED
+CVE-2020-13151 (Aerospike Community Edition 4.9.0.5 allows for unauthenticated
submiss ...)
+ TODO: check
CVE-2020-13150 (D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately
90 secon ...)
NOT-FOR-US: D-link
CVE-2020-13149 (Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center"
folder in Dr ...)
@@ -22719,8 +22743,8 @@ CVE-2020-8608 (In libslirp 4.1.0, as used in QEMU
4.2.0, tcp_subr.c misuses snpr
NOTE:
https://gitlab.freedesktop.org/slirp/libslirp/commit/30648c03b27fb8d9611b723184216cd3174b6775
NOTE: qemu 1:4.1-2 switched to system libslirp, marking that version as
fixed.
NOTE: slirp4netns 1.0.1-1 switched to system libslirp, marking that
version as fixed.
-CVE-2020-8607
- RESERVED
+CVE-2020-8607 (An input validation vulnerability found in multiple Trend Micro
produc ...)
+ TODO: check
CVE-2020-8606 (A vulnerability in Trend Micro InterScan Web Security Virtual
Applianc ...)
NOT-FOR-US: Trend Micro
CVE-2020-8605 (A vulnerability in Trend Micro InterScan Web Security Virtual
Applianc ...)
@@ -25078,7 +25102,7 @@ CVE-2020-7639 (eivindfjeldstad-dot below 1.0.3 is
vulnerable to Prototype Pollut
NOT-FOR-US: Node eivindfjeldstad-dot
CVE-2020-7638 (confinit through 0.3.0 is vulnerable to Prototype Pollution.The
'setDe ...)
NOT-FOR-US: Node confinit
-CVE-2020-7637 (class-transformer through 0.2.3 is vulnerable to Prototype
Pollution. ...)
+CVE-2020-7637 (class-transformer before 0.3.1 allow attackers to perform
Prototype Po ...)
NOT-FOR-US: Node class-transformer
CVE-2020-7636 (adb-driver through 0.1.8 is vulnerable to Command Injection.It
allows ...)
NOT-FOR-US: Node adb-driver
@@ -30033,10 +30057,10 @@ CVE-2020-5611 (Cross-site request forgery (CSRF)
vulnerability in Social Sharing
NOT-FOR-US: Social Sharing Plugin for WordPress
CVE-2020-5610 (Global TechStream (GTS) for TOYOTA dealers version 15.10.032
and earli ...)
NOT-FOR-US: Global TechStream (GTS) for TOYOTA dealers
-CVE-2020-5609
- RESERVED
-CVE-2020-5608
- RESERVED
+CVE-2020-5609 (Directory traversal vulnerability in CAMS for HIS CENTUM CS
3000 (incl ...)
+ TODO: check
+CVE-2020-5608 (CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small)
R3.08.10 t ...)
+ TODO: check
CVE-2020-5607 (Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier
allows re ...)
NOT-FOR-US: SHIRASAGI
CVE-2020-5606
@@ -32977,8 +33001,8 @@ CVE-2020-4483
RESERVED
CVE-2020-4482
RESERVED
-CVE-2020-4481
- RESERVED
+CVE-2020-4481 (IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and
7.0.4.0 is v ...)
+ TODO: check
CVE-2020-4480
RESERVED
CVE-2020-4479
@@ -33453,8 +33477,8 @@ CVE-2020-4245 (IBM Security Identity Governance and
Intelligence 5.2.6 does not
NOT-FOR-US: IBM
CVE-2020-4244 (IBM Security Identity Governance and Intelligence 5.2.6 could
allow an ...)
NOT-FOR-US: IBM
-CVE-2020-4243
- RESERVED
+CVE-2020-4243 (IBM Security Identity Governance and Intelligence 5.2.6 Virtual
Applia ...)
+ TODO: check
CVE-2020-4242 (IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through
10.1.5 ...)
NOT-FOR-US: IBM
CVE-2020-4241 (IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through
10.1.5 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a24d63179b179ca256ff2310779e0e6238691fa4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a24d63179b179ca256ff2310779e0e6238691fa4
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
