Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b3bcdf6a by security tracker role at 2021-05-24T20:10:29+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,25 @@
+CVE-2021-3564
+ RESERVED
+CVE-2021-33524
+ RESERVED
+CVE-2021-33523
+ RESERVED
+CVE-2021-33522
+ RESERVED
+CVE-2021-33521
+ RESERVED
+CVE-2021-33520
+ RESERVED
+CVE-2021-33519
+ RESERVED
+CVE-2021-33518
+ RESERVED
+CVE-2021-33517
+ RESERVED
+CVE-2021-33516 (An issue was discovered in GUPnP before 1.0.7 and 1.1.x and
1.2.x befo ...)
+ TODO: check
+CVE-2021-33515
+ RESERVED
CVE-2021-33514 (Certain NETGEAR devices are affected by command injection by
an unauth ...)
NOT-FOR-US: Netgear
CVE-2021-33513 (Plone through 5.2.4 allows XSS via the inline_diff methods in
Products ...)
@@ -22,8 +44,8 @@ CVE-2021-33504
RESERVED
CVE-2021-33503
RESERVED
-CVE-2021-33502
- RESERVED
+CVE-2021-33502 (The normalize-url package before 4.5.1, 5.x before 5.3.1, and
6.x befo ...)
+ TODO: check
CVE-2021-33501
RESERVED
CVE-2021-33500 (PuTTY before 0.75 on Windows allows remote servers to cause a
denial o ...)
@@ -627,8 +649,7 @@ CVE-2021-33206
RESERVED
CVE-2021-33205
RESERVED
-CVE-2021-3559 [nodedev-list command may cause libvirt to crash on hosts with
GRID driver installed]
- RESERVED
+CVE-2021-3559 (A flaw was found in libvirt in the virConnectListAllNodeDevices
API in ...)
- libvirt <not-affected> (Vulnerable code never in a released version)
NOTE: Fixed by:
https://gitlab.com/libvirt/libvirt/-/commit/4c4d0e2da07b5a035b26a0ff13ec27070f7c7b1a
(v7.0.0-rc1)
NOTE: Introduced by:
https://gitlab.com/libvirt/libvirt/-/commit/f1b08901f7ae7557f79d83bdac33cc0bd79d1437
(v6.10.0-rc1)
@@ -1880,8 +1901,8 @@ CVE-2021-32631
RESERVED
CVE-2021-32630 (Admidio is a free, open source user management system for
websites of ...)
NOT-FOR-US: Admidio
-CVE-2021-32629
- RESERVED
+CVE-2021-32629 (Cranelift is an open-source code generator maintained by
Bytecode Alli ...)
+ TODO: check
CVE-2021-32628
RESERVED
CVE-2021-32627
@@ -1890,8 +1911,8 @@ CVE-2021-32626
RESERVED
CVE-2021-32625
RESERVED
-CVE-2021-32624
- RESERVED
+CVE-2021-32624 (Keystone 5 is an open source CMS platform to build Node.js
application ...)
+ TODO: check
CVE-2021-32623
RESERVED
CVE-2021-32622 (Matrix-React-SDK is a react-based SDK for inserting a Matrix
chat/voip ...)
@@ -3082,8 +3103,8 @@ CVE-2021-32077 (Primary Source Verification in
VerityStream MSOW Solutions befor
NOT-FOR-US: VerityStream MSOW Solutions
CVE-2021-32076
RESERVED
-CVE-2021-32075
- RESERVED
+CVE-2021-32075 (Re-Logic Terraria before 1.4.2.3 performs Insecure
Deserialization. ...)
+ TODO: check
CVE-2021-32074 (HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0
allows a ...)
NOT-FOR-US: HashiCorp vault-action (aka Vault GitHub Action)
CVE-2021-32073 (DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a
remote at ...)
@@ -7520,8 +7541,8 @@ CVE-2020-36316 (In RELIC before 2021-04-03, there is a
buffer overflow in PKCS#1
NOT-FOR-US: RELIC
CVE-2020-36315 (In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery
can occu ...)
NOT-FOR-US: RELIC
-CVE-2021-3485
- RESERVED
+CVE-2021-3485 (An Improper Input Validation vulnerability in the Product
Update featu ...)
+ TODO: check
CVE-2021-30244
RESERVED
CVE-2021-30243
@@ -7964,12 +7985,12 @@ CVE-2021-30085
RESERVED
CVE-2021-30084
RESERVED
-CVE-2021-30083
- RESERVED
-CVE-2021-30082
- RESERVED
-CVE-2021-30081
- RESERVED
+CVE-2021-30083 (An issue was discovered in Mediat 1.4.1. There is a Reflected
XSS vuln ...)
+ TODO: check
+CVE-2021-30082 (An issue was discovered in Gris CMS v0.1. There is a
Persistent XSS vu ...)
+ TODO: check
+CVE-2021-30081 (An issue was discovered in emlog 6.0.0stable. There is a SQL
Injection ...)
+ TODO: check
CVE-2021-30080
RESERVED
CVE-2021-30079
@@ -9880,8 +9901,8 @@ CVE-2021-29302 (TP-Link TL-WR802N(US), Archer_C50v5_US
v4_200 <= 2020.06 cont
NOT-FOR-US: TP-Link
CVE-2021-29301
RESERVED
-CVE-2021-29300
- RESERVED
+CVE-2021-29300 (The @ronomon/opened library before 1.5.2 is vulnerable to a
command in ...)
+ TODO: check
CVE-2021-29299
RESERVED
CVE-2021-29298
@@ -10001,8 +10022,8 @@ CVE-2021-29258 (An issue was discovered in Envoy
1.14.0. There is a remotely exp
- envoyproxy <itp> (bug #987544)
CVE-2021-29257
RESERVED
-CVE-2021-29256
- RESERVED
+CVE-2021-29256 (. The Arm Mali GPU kernel driver allows an unprivileged user
to achiev ...)
+ TODO: check
CVE-2021-29255 (MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin
credent ...)
NOT-FOR-US: MicroSeven
CVE-2021-29254
@@ -17864,8 +17885,8 @@ CVE-2021-25940
RESERVED
CVE-2021-25939
RESERVED
-CVE-2021-25938
- RESERVED
+CVE-2021-25938 (In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable
to Cross ...)
+ TODO: check
CVE-2021-25937
RESERVED
CVE-2021-25936
@@ -21624,8 +21645,8 @@ CVE-2021-24334
RESERVED
CVE-2021-24333
RESERVED
-CVE-2021-24332
- RESERVED
+CVE-2021-24332 (The Autoptimize WordPress plugin before 2.8.4 was missing
proper escap ...)
+ TODO: check
CVE-2021-24331
RESERVED
CVE-2021-24330
@@ -21672,36 +21693,36 @@ CVE-2021-24310
RESERVED
CVE-2021-24309
RESERVED
-CVE-2021-24308
- RESERVED
-CVE-2021-24307
- RESERVED
-CVE-2021-24306
- RESERVED
-CVE-2021-24305
- RESERVED
+CVE-2021-24308 (The 'State' field of the Edit profile page of the LMS by
LifterLMS  ...)
+ TODO: check
+CVE-2021-24307 (The All in One SEO – Best WordPress SEO Plugin –
Easily Im ...)
+ TODO: check
+CVE-2021-24306 (The Ultimate Member – User Profile, User Registration,
Login &am ...)
+ TODO: check
+CVE-2021-24305 (The Target First WordPress Plugin v2.0, also previously known
as Watch ...)
+ TODO: check
CVE-2021-24304
RESERVED
CVE-2021-24303
RESERVED
-CVE-2021-24302
- RESERVED
-CVE-2021-24301
- RESERVED
-CVE-2021-24300
- RESERVED
+CVE-2021-24302 (The Hana Flv Player WordPress plugin through 3.1.3 is
vulnerable to an ...)
+ TODO: check
+CVE-2021-24301 (The Hotjar Connecticator WordPress plugin through 1.1.1 is
vulnerable ...)
+ TODO: check
+CVE-2021-24300 (The slider import search feature of the PickPlugins Product
Slider for ...)
+ TODO: check
CVE-2021-24299 (The ReDi Restaurant Reservation WordPress plugin before
21.0426 provid ...)
NOT-FOR-US: WordPress plugin
-CVE-2021-24298
- RESERVED
-CVE-2021-24297
- RESERVED
-CVE-2021-24296
- RESERVED
+CVE-2021-24298 (The method and share GET parameters of the Giveaway pages were
not san ...)
+ TODO: check
+CVE-2021-24297 (The Goto WordPress theme before 2.1 did not properly sanitize
the form ...)
+ TODO: check
+CVE-2021-24296 (The WP Customer Reviews WordPress plugin before 3.5.6 did not
sanitise ...)
+ TODO: check
CVE-2021-24295 (It was possible to exploit an Unauthenticated Time-Based Blind
SQL Inj ...)
NOT-FOR-US: WordPress plugin
-CVE-2021-24294
- RESERVED
+CVE-2021-24294 (The dsgvoaio_write_log AJAX action of the DSGVO All in one for
WP Word ...)
+ TODO: check
CVE-2021-24293 (In the eCommerce module of the NextGEN Gallery Pro WordPress
plugin be ...)
NOT-FOR-US: NextGEN Gallery Pro WordPress plugin
CVE-2021-24292 (The Happy Addons for Elementor WordPress plugin before 2.24.0,
Happy A ...)
@@ -23811,8 +23832,8 @@ CVE-2021-23389
RESERVED
CVE-2021-23388
RESERVED
-CVE-2021-23387
- RESERVED
+CVE-2021-23387 (The package trailing-slash before 2.0.1 are vulnerable to Open
Redirec ...)
+ TODO: check
CVE-2021-23386 (This affects the package dns-packet before 5.2.2. It creates
buffers w ...)
NOT-FOR-US: Node dns-packet
CVE-2021-23385
@@ -26895,12 +26916,12 @@ CVE-2021-21991
RESERVED
CVE-2021-21990 (VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101
prior t ...)
NOT-FOR-US: VMware
-CVE-2021-21989
- RESERVED
-CVE-2021-21988
- RESERVED
-CVE-2021-21987
- RESERVED
+CVE-2021-21989 (VMware Workstation (16.x prior to 16.1.2) and Horizon Client
for Windo ...)
+ TODO: check
+CVE-2021-21988 (VMware Workstation (16.x prior to 16.1.2) and Horizon Client
for Windo ...)
+ TODO: check
+CVE-2021-21987 (VMware Workstation (16.x prior to 16.1.2) and Horizon Client
for Windo ...)
+ TODO: check
CVE-2021-21986
RESERVED
CVE-2021-21985
@@ -30757,10 +30778,10 @@ CVE-2021-21003
RESERVED
CVE-2021-21002
RESERVED
-CVE-2021-21001
- RESERVED
-CVE-2021-21000
- RESERVED
+CVE-2021-21001 (On WAGO PFC200 devices in different firmware versions with
special cra ...)
+ TODO: check
+CVE-2021-21000 (On WAGO PFC200 devices in different firmware versions with
special cra ...)
+ TODO: check
CVE-2021-20999 (In Weidmüller u-controls and IoT-Gateways in versions up
to 1.12. ...)
NOT-FOR-US: Weidmueller u-controls and IoT Gateways
CVE-2021-20998 (In multiple managed switches by WAGO in different versions
without aut ...)
@@ -31648,8 +31669,8 @@ CVE-2021-20559 (IBM Control Desk 7.6.1.2 and 7.6.1.3 is
vulnerable to cross-site
NOT-FOR-US: IBM
CVE-2021-20558
RESERVED
-CVE-2021-20557
- RESERVED
+CVE-2021-20557 (IBM Security Guardium 11.2 could allow a remote authenticated
attacker ...)
+ TODO: check
CVE-2021-20556
RESERVED
CVE-2021-20555
@@ -31906,12 +31927,12 @@ CVE-2021-20430
RESERVED
CVE-2021-20429 (IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could
disclose ...)
NOT-FOR-US: IBM
-CVE-2021-20428
- RESERVED
+CVE-2021-20428 (IBM Security Guardium 11.2 could allow a remote attacker to
obtain sen ...)
+ TODO: check
CVE-2021-20427
RESERVED
-CVE-2021-20426
- RESERVED
+CVE-2021-20426 (IBM Security Guardium 11.2 contains hard-coded credentials,
such as a ...)
+ TODO: check
CVE-2021-20425
RESERVED
CVE-2021-20424
@@ -31924,8 +31945,8 @@ CVE-2021-20421
RESERVED
CVE-2021-20420
RESERVED
-CVE-2021-20419
- RESERVED
+CVE-2021-20419 (IBM Security Guardium 11.2 uses weaker than expected
cryptographic alg ...)
+ TODO: check
CVE-2021-20418
RESERVED
CVE-2021-20417
@@ -31984,16 +32005,16 @@ CVE-2021-20391 (IBM QRadar User Behavior Analytics
1.0.0 through 4.1.0 allows we
NOT-FOR-US: IBM
CVE-2021-20390
RESERVED
-CVE-2021-20389
- RESERVED
+CVE-2021-20389 (IBM Security Guardium 11.2 stores user credentials in plain
clear text ...)
+ TODO: check
CVE-2021-20388
RESERVED
CVE-2021-20387
RESERVED
-CVE-2021-20386
- RESERVED
-CVE-2021-20385
- RESERVED
+CVE-2021-20386 (IBM Security Guardium 11.2 is vulnerable to cross-site
scripting. This ...)
+ TODO: check
+CVE-2021-20385 (IBM Security Guardium 11.2 could allow a remote authenticated
attacker ...)
+ TODO: check
CVE-2021-20384
RESERVED
CVE-2021-20383
@@ -37947,30 +37968,30 @@ CVE-2020-28912 (With MariaDB running on Windows, when
local clients connect to t
- mariadb-10.1 <not-affected> (Only affects MariaDB on Windows)
NOTE: https://jira.mariadb.org/browse/MDEV-24040
NOTE: https://github.com/MariaDB/server/commit/3829b408d6
-CVE-2020-28911
- RESERVED
-CVE-2020-28910
- RESERVED
-CVE-2020-28909
- RESERVED
-CVE-2020-28908
- RESERVED
-CVE-2020-28907
- RESERVED
-CVE-2020-28906
- RESERVED
-CVE-2020-28905
- RESERVED
-CVE-2020-28904
- RESERVED
-CVE-2020-28903
- RESERVED
-CVE-2020-28902
- RESERVED
-CVE-2020-28901
- RESERVED
-CVE-2020-28900
- RESERVED
+CVE-2020-28911 (Incorrect Access Control in Nagios Fusion 4.1.8 and earlier
allows low ...)
+ TODO: check
+CVE-2020-28910 (Creation of a Temporary Directory with Insecure Permissions in
Nagios ...)
+ TODO: check
+CVE-2020-28909 (Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier
allows f ...)
+ TODO: check
+CVE-2020-28908 (Command Injection in Nagios Fusion 4.1.8 and earlier allows
for Privil ...)
+ TODO: check
+CVE-2020-28907 (Incorrect SSL certificate validation in Nagios Fusion 4.1.8
and earlie ...)
+ TODO: check
+CVE-2020-28906 (Incorrect File Permissions in Nagios XI 5.7.5 and earlier and
Nagios F ...)
+ TODO: check
+CVE-2020-28905 (Improper Input Validation in Nagios Fusion 4.1.8 and earlier
allows an ...)
+ TODO: check
+CVE-2020-28904 (Execution with Unnecessary Privileges in Nagios Fusion 4.1.8
and earli ...)
+ TODO: check
+CVE-2020-28903 (Improper input validation in Nagios Fusion 4.1.8 and earlier
allows a ...)
+ TODO: check
+CVE-2020-28902 (Command Injection in Nagios Fusion 4.1.8 and earlier allows
Privilege ...)
+ TODO: check
+CVE-2020-28901 (Command Injection in Nagios Fusion 4.1.8 and earlier allows
for Privil ...)
+ TODO: check
+CVE-2020-28900 (Insufficient Verification of Data Authenticity in Nagios
Fusion 4.1.8 ...)
+ TODO: check
CVE-2020-28899 (The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0
devices does ...)
NOT-FOR-US: ZyXEL
CVE-2020-28898 (In QED ResourceXpress through 4.9k, a large numeric or
alphanumeric va ...)
@@ -43143,7 +43164,7 @@ CVE-2021-0232 (An authentication bypass vulnerability
in the Juniper Networks Pa
NOT-FOR-US: Juniper
CVE-2021-0231 (A path traversal vulnerability in the Juniper Networks SRX and
vSRX Se ...)
NOT-FOR-US: Juniper
-CVE-2021-0230 (On Juniper Networks Junos OS platforms with link aggregation
(lag) con ...)
+CVE-2021-0230 (On Juniper Networks SRX Series devices with link aggregation
(lag) con ...)
NOT-FOR-US: Juniper
CVE-2021-0229 (An uncontrolled resource consumption vulnerability in Message
Queue Te ...)
NOT-FOR-US: Juniper
@@ -46891,18 +46912,18 @@ CVE-2020-26562
RESERVED
CVE-2020-26561 (** UNSUPPORTED WHEN ASSIGNED ** Belkin LINKSYS WRT160NL
1.0.04.002_US_ ...)
NOT-FOR-US: Belkin
-CVE-2020-26560
- RESERVED
-CVE-2020-26559
- RESERVED
-CVE-2020-26558
- RESERVED
-CVE-2020-26557
- RESERVED
-CVE-2020-26556
- RESERVED
-CVE-2020-26555
- RESERVED
+CVE-2020-26560 (Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0
and 1.0. ...)
+ TODO: check
+CVE-2020-26559 (Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0
and 1.0. ...)
+ TODO: check
+CVE-2020-26558 (Bluetooth LE and BR/EDR secure pairing in Bluetooth Core
Specification ...)
+ TODO: check
+CVE-2020-26557 (Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1
may perm ...)
+ TODO: check
+CVE-2020-26556 (Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1
may perm ...)
+ TODO: check
+CVE-2020-26555 (Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core
Specificati ...)
+ TODO: check
CVE-2020-26554 (REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an
incoming HTML ...)
NOT-FOR-US: REDDOXX MailDepot
CVE-2020-26553 (An issue was discovered in Aviatrix Controller before
R6.0.2483. Sever ...)
@@ -48192,8 +48213,8 @@ CVE-2020-26008
RESERVED
CVE-2020-26007
RESERVED
-CVE-2020-26006
- RESERVED
+CVE-2020-26006 (Project Worlds Online Examination System 1.0 is affected by
Cross Site ...)
+ TODO: check
CVE-2020-26005
RESERVED
CVE-2020-26004
@@ -49770,14 +49791,14 @@ CVE-2020-25412 (com_line() in command.c in gnuplot
5.4 leads to an out-of-bounds
NOTE: https://sourceforge.net/p/gnuplot/bugs/2303/
NOTE: No security impact, gnuplot can execute arbitrary commands and
need to
NOTE: come from a trusted source, see README.Debian.security (added in
5.2.6).
-CVE-2020-25411
- RESERVED
+CVE-2020-25411 (Projectworlds Online Examination System 1.0 is vulnerable to
CSRF, whi ...)
+ TODO: check
CVE-2020-25410
RESERVED
-CVE-2020-25409
- RESERVED
-CVE-2020-25408
- RESERVED
+CVE-2020-25409 (Projectsworlds College Management System Php 1.0 is vulnerable
to SQL ...)
+ TODO: check
+CVE-2020-25408 (A Cross-Site Request Forgery (CSRF) vulnerability exists in
ProjectWor ...)
+ TODO: check
CVE-2020-25407
RESERVED
CVE-2020-25406 (app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows
users to ...)
@@ -58903,8 +58924,8 @@ CVE-2020-21043
RESERVED
CVE-2020-21042
RESERVED
-CVE-2020-21041
- RESERVED
+CVE-2020-21041 (Buffer Overflow vulnerability exists in FFmpeg 4.1 via
apng_do_inverse ...)
+ TODO: check
CVE-2020-21040
RESERVED
CVE-2020-21039
@@ -59171,8 +59192,8 @@ CVE-2020-20909
RESERVED
CVE-2020-20908
RESERVED
-CVE-2020-20907
- RESERVED
+CVE-2020-20907 (MetInfo 7.0 beta is affected by a file modification
vulnerability. Att ...)
+ TODO: check
CVE-2020-20906
RESERVED
CVE-2020-20905
@@ -60637,8 +60658,8 @@ CVE-2020-20180
RESERVED
CVE-2020-20179
RESERVED
-CVE-2020-20178
- RESERVED
+CVE-2020-20178 (A flaw was found in OpenLDAP. This flaw allows an attacker who
can sen ...)
+ TODO: check
CVE-2020-20177
RESERVED
CVE-2020-20176
@@ -100083,8 +100104,8 @@ CVE-2020-4992
RESERVED
CVE-2020-4991
RESERVED
-CVE-2020-4990
- RESERVED
+CVE-2020-4990 (IBM Security Guardium 11.2 is vulnerable to SQL injection. A
remote at ...)
+ TODO: check
CVE-2020-4989
RESERVED
CVE-2020-4988 (Loopback 8.0.0 contains a vulnerability that could allow an
attacker t ...)
@@ -134594,8 +134615,8 @@ CVE-2019-12350
RESERVED
CVE-2019-12349
RESERVED
-CVE-2019-12348
- RESERVED
+CVE-2019-12348 (An issue was discovered in zzcms 2019. SQL Injection exists in
user/zt ...)
+ TODO: check
CVE-2019-12347 (In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when
attackers ...)
NOT-FOR-US: pfSense
CVE-2019-12346 (In the miniOrange SAML SP Single Sign On plugin before 4.8.73
for Word ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b3bcdf6a5ee87cc5bce8e1a7fa4404873fd803bb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b3bcdf6a5ee87cc5bce8e1a7fa4404873fd803bb
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
