Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
beb2ab04 by security tracker role at 2021-10-22T20:10:19+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,75 @@
+CVE-2021-42847
+ RESERVED
+CVE-2021-42846
+ RESERVED
+CVE-2021-42845
+ RESERVED
+CVE-2021-42844
+ RESERVED
+CVE-2021-42843
+ RESERVED
+CVE-2021-42842
+ RESERVED
+CVE-2021-42841
+ RESERVED
+CVE-2021-42840 (SuiteCRM before 7.11.19 allows remote code execution via the
system se ...)
+ TODO: check
+CVE-2021-42839
+ RESERVED
+CVE-2021-42838
+ RESERVED
+CVE-2021-42837
+ RESERVED
+CVE-2021-42836 (GJSON before 1.9.3 allows a ReDoS (regular expression denial
of servic ...)
+ TODO: check
+CVE-2021-42835
+ RESERVED
+CVE-2021-42834
+ RESERVED
+CVE-2021-42833
+ RESERVED
+CVE-2021-42832
+ RESERVED
+CVE-2021-42831
+ RESERVED
+CVE-2021-42830
+ RESERVED
+CVE-2021-42829
+ RESERVED
+CVE-2021-42828
+ RESERVED
+CVE-2021-42827
+ RESERVED
+CVE-2021-42826
+ RESERVED
+CVE-2021-42825
+ RESERVED
+CVE-2021-42824
+ RESERVED
+CVE-2021-42823
+ RESERVED
+CVE-2021-42822
+ RESERVED
+CVE-2021-42821
+ RESERVED
+CVE-2021-42820
+ RESERVED
+CVE-2021-42819
+ RESERVED
+CVE-2021-42818
+ RESERVED
+CVE-2021-42817
+ RESERVED
+CVE-2021-42816
+ RESERVED
+CVE-2021-42815
+ RESERVED
+CVE-2021-42814
+ RESERVED
+CVE-2021-42813
+ RESERVED
+CVE-2021-3896
+ RESERVED
CVE-2021-42812
RESERVED
CVE-2021-42811
@@ -558,8 +630,8 @@ CVE-2021-42558
RESERVED
CVE-2021-42557
RESERVED
-CVE-2021-42556
- RESERVED
+CVE-2021-42556 (Rasa X before 0.42.4 allows Directory Traversal during archive
extract ...)
+ TODO: check
CVE-2021-42555
RESERVED
CVE-2021-42554
@@ -602,24 +674,24 @@ CVE-2021-42544
RESERVED
CVE-2021-42543
RESERVED
-CVE-2021-42542
- RESERVED
+CVE-2021-42542 (The affected product is vulnerable to directory traversal due
to misha ...)
+ TODO: check
CVE-2021-42541
RESERVED
-CVE-2021-42540
- RESERVED
-CVE-2021-42539
- RESERVED
-CVE-2021-42538
- RESERVED
+CVE-2021-42540 (The affected product is vulnerable to a unsanitized extract
folder for ...)
+ TODO: check
+CVE-2021-42539 (The affected product is vulnerable to a missing permission
validation ...)
+ TODO: check
+CVE-2021-42538 (The affected product is vulnerable to a parameter injection
via passph ...)
+ TODO: check
CVE-2021-42537
RESERVED
-CVE-2021-42536
- RESERVED
+CVE-2021-42536 (The affected product is vulnerable to a disclosure of peer
username an ...)
+ TODO: check
CVE-2021-42535
RESERVED
-CVE-2021-42534
- RESERVED
+CVE-2021-42534 (The affected product’s web application does not properly
neutral ...)
+ TODO: check
CVE-2021-42533
RESERVED
CVE-2021-42532
@@ -2620,8 +2692,8 @@ CVE-2021-42171
RESERVED
CVE-2021-42170
RESERVED
-CVE-2021-42169
- RESERVED
+CVE-2021-42169 (The Simple Payroll System with Dynamic Tax Bracket in PHP
using SQLite ...)
+ TODO: check
CVE-2021-42168
RESERVED
CVE-2021-42167
@@ -2808,12 +2880,14 @@ CVE-2021-42099
CVE-2021-42098 (An incomplete permission check on entries in Devolutions
Remote Deskto ...)
NOT-FOR-US: Devolutions
CVE-2021-42097 (GNU Mailman before 2.1.35 may allow remote Privilege
Escalation. A csr ...)
+ {DSA-4991-1}
- mailman <removed>
NOTE: Fixed by:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1873
NOTE: https://bugs.launchpad.net/mailman/+bug/1947640
NOTE:
https://mail.python.org/archives/list/mailman-annou...@python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/
NOTE: https://www.openwall.com/lists/oss-security/2021/10/21/4
CVE-2021-42096 (GNU Mailman before 2.1.35 may allow remote Privilege
Escalation. A cer ...)
+ {DSA-4991-1}
- mailman <removed>
NOTE: Fixed by:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1873
NOTE: https://bugs.launchpad.net/mailman/+bug/1947639
@@ -3666,14 +3740,14 @@ CVE-2021-41749
RESERVED
CVE-2021-41748
RESERVED
-CVE-2021-41747
- RESERVED
+CVE-2021-41747 (Cross-Site Scripting (XSS) vulnerability exists in Csdn APP
4.10.0, wh ...)
+ TODO: check
CVE-2021-41746
RESERVED
-CVE-2021-41745
- RESERVED
-CVE-2021-41744
- RESERVED
+CVE-2021-41745 (ShowDoc 2.8.3 ihas a file upload vulnerability, where
attackers can us ...)
+ TODO: check
+CVE-2021-41744 (All versions of yongyou PLM are affected by a command
injection issue. ...)
+ TODO: check
CVE-2021-41743
RESERVED
CVE-2021-41742
@@ -4930,8 +5004,8 @@ CVE-2021-41173
RESERVED
CVE-2021-41172
RESERVED
-CVE-2021-41171
- RESERVED
+CVE-2021-41171 (eLabFTW is an open source electronic lab notebook manager for
research ...)
+ TODO: check
CVE-2021-41170
RESERVED
CVE-2021-41169 (Sulu is an open-source PHP content management system based on
the Symf ...)
@@ -11300,80 +11374,80 @@ CVE-2021-38487
RESERVED
CVE-2021-38486 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 cl ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38485
- RESERVED
+CVE-2021-38485 (The affected product is vulnerable to improper input
validation in the ...)
+ TODO: check
CVE-2021-38484 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 do ...)
NOT-FOR-US: InHand Networks IR615 Router
CVE-2021-38483
RESERVED
CVE-2021-38482 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 we ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38481
- RESERVED
+CVE-2021-38481 (The scheduler service running on a specific TCP port enables
the user ...)
+ TODO: check
CVE-2021-38480 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ar ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38479
- RESERVED
+CVE-2021-38479 (Many API function codes receive raw pointers remotely from the
user an ...)
+ TODO: check
CVE-2021-38478 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ar ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38477
- RESERVED
+CVE-2021-38477 (There are multiple API function codes that permit reading and
writing ...)
+ TODO: check
CVE-2021-38476 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 au ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38475
- RESERVED
+CVE-2021-38475 (The database connection to the server is performed by calling
a specif ...)
+ TODO: check
CVE-2021-38474 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ha ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38473
- RESERVED
+CVE-2021-38473 (The affected product’s code base doesn’t properly
control ...)
+ TODO: check
CVE-2021-38472 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ma ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38471
- RESERVED
+CVE-2021-38471 (There are multiple API function codes that permit data writing
to any ...)
+ TODO: check
CVE-2021-38470 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ar ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38469
- RESERVED
+CVE-2021-38469 (Many of the services used by the affected product do not
specify full ...)
+ TODO: check
CVE-2021-38468 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ar ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38467
- RESERVED
+CVE-2021-38467 (A specific function code receives a raw pointer supplied by
the user a ...)
+ TODO: check
CVE-2021-38466 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 do ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38465
- RESERVED
+CVE-2021-38465 (The webinstaller is a Golang web server executable that
enables the ge ...)
+ TODO: check
CVE-2021-38464 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 ha ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38463
- RESERVED
+CVE-2021-38463 (The affected product does not properly control the allocation
of resou ...)
+ TODO: check
CVE-2021-38462 (InHand Networks IR615 Router's Versions 2.3.0.r4724 and
2.3.0.r4870 do ...)
NOT-FOR-US: InHand Networks IR615 Router
-CVE-2021-38461
- RESERVED
+CVE-2021-38461 (The affected product uses a hard-coded blowfish key for
encryption/dec ...)
+ TODO: check
CVE-2021-38460 (A path traversal vulnerability in the Moxa MXview Network
Management s ...)
NOT-FOR-US: Moxa
-CVE-2021-38459
- RESERVED
+CVE-2021-38459 (The data of a network capture of the initial handshake phase
can be us ...)
+ TODO: check
CVE-2021-38458 (A path traversal vulnerability in the Moxa MXview Network
Management s ...)
NOT-FOR-US: Moxa
-CVE-2021-38457
- RESERVED
+CVE-2021-38457 (The server permits communication without any authentication
procedure, ...)
+ TODO: check
CVE-2021-38456 (A path traversal vulnerability in the Moxa MXview Network
Management s ...)
NOT-FOR-US: Moxa
-CVE-2021-38455
- RESERVED
+CVE-2021-38455 (The affected product’s OS Service does not verify any
given para ...)
+ TODO: check
CVE-2021-38454 (A path traversal vulnerability in the Moxa MXview Network
Management s ...)
NOT-FOR-US: Moxa
-CVE-2021-38453
- RESERVED
+CVE-2021-38453 (Some API functions allow interaction with the registry, which
includes ...)
+ TODO: check
CVE-2021-38452 (A path traversal vulnerability in the Moxa MXview Network
Management s ...)
NOT-FOR-US: Moxa
-CVE-2021-38451
- RESERVED
+CVE-2021-38451 (The affected product’s proprietary protocol CSC allows
for calli ...)
+ TODO: check
CVE-2021-38450
RESERVED
-CVE-2021-38449
- RESERVED
+CVE-2021-38449 (Some API functions permit by-design writing or copying data
into a giv ...)
+ TODO: check
CVE-2021-38448
RESERVED
CVE-2021-38447
@@ -16347,8 +16421,8 @@ CVE-2021-36359 (OrbiTeam BSCW Classic before 7.4.3
allows exportpdf authenticate
NOT-FOR-US: OrbiTeam BSCW Classic
CVE-2021-36358
RESERVED
-CVE-2021-36357
- RESERVED
+CVE-2021-36357 (An issue was discovered in OpenPOWER 2.6 firmware.
unpack_timestamp() ...)
+ TODO: check
CVE-2021-36356 (KRAMER VIAware through August 2021 allows remote attackers to
execute ...)
NOT-FOR-US: KRAMER VIAware
CVE-2021-36355
@@ -19059,8 +19133,8 @@ CVE-2021-35232
RESERVED
CVE-2021-35231
RESERVED
-CVE-2021-35230
- RESERVED
+CVE-2021-35230 (As a result of an unquoted service path vulnerability present
in the K ...)
+ TODO: check
CVE-2021-35229
RESERVED
CVE-2021-35228 (This vulnerability occurred due to missing input sanitization
for one ...)
@@ -27390,10 +27464,10 @@ CVE-2021-31837 (Memory corruption vulnerability in
the driver file component in
NOT-FOR-US: McAfee
CVE-2021-31836 (Improper privilege management vulnerability in maconfig for
McAfee Age ...)
NOT-FOR-US: McAfee
-CVE-2021-31835
- RESERVED
-CVE-2021-31834
- RESERVED
+CVE-2021-31835 (Cross-Site Scripting vulnerability in McAfee ePolicy
Orchestrator (ePO ...)
+ TODO: check
+CVE-2021-31834 (Stored Cross-Site Scripting vulnerability in McAfee ePolicy
Orchestrat ...)
+ TODO: check
CVE-2021-31833
RESERVED
CVE-2021-31832 (Improper Neutralization of Input in the ePO administrator
extension fo ...)
@@ -27883,8 +27957,8 @@ CVE-2021-31684 (A vulnerability was discovered in the
indexOf function of JSONPa
NOTE: Security impact disputed by upstream
CVE-2021-31683
RESERVED
-CVE-2021-31682
- RESERVED
+CVE-2021-31682 (The login portal for the Automated Logic WebCTRL/WebCTRL OEM
web appli ...)
+ TODO: check
CVE-2021-31681
RESERVED
CVE-2021-31680
@@ -31275,8 +31349,8 @@ CVE-2021-30361
RESERVED
CVE-2021-30360
RESERVED
-CVE-2021-30359
- RESERVED
+CVE-2021-30359 (The Harmony Browse and the SandBlast Agent for Browsers
installers mus ...)
+ TODO: check
CVE-2021-30358 (Mobile Access Portal Native Applications who's path is defined
by the ...)
NOT-FOR-US: Mobile Access Portal Native Applications
CVE-2021-30357 (SSL Network Extender Client for Linux before build 800008302
reveals p ...)
@@ -32698,8 +32772,8 @@ CVE-2021-29837 (IBM Sterling B2B Integrator Standard
Edition 5.2.0.0 through 6.1
NOT-FOR-US: IBM
CVE-2021-29836 (IBM Sterling B2B Integrator Standard Edition 5.2.0.0. through
6.1.1.0 ...)
NOT-FOR-US: IBM
-CVE-2021-29835
- RESERVED
+CVE-2021-29835 (IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is
vulnera ...)
+ TODO: check
CVE-2021-29834 (IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2,
19.0.0. ...)
NOT-FOR-US: IBM
CVE-2021-29833 (IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli
Netcool/OMNIbu ...)
@@ -48129,7 +48203,7 @@ CVE-2021-23451
RESERVED
CVE-2021-23450
RESERVED
-CVE-2021-23449 (This affects the package vm2 before 3.9.4. Prototype Pollution
attack ...)
+CVE-2021-23449 (This affects the package vm2 before 3.9.4 via a Prototype
Pollution at ...)
TODO: check
CVE-2021-23448 (All versions of package config-handler are vulnerable to
Prototype Pol ...)
TODO: check
@@ -48146,9 +48220,10 @@ CVE-2021-23443 (This affects the package edge.js
before 5.3.2. A type confusion
NOT-FOR-US: Node edge.js
CVE-2021-23442 (This affects all versions of package @cookiex/deep. The global
proto o ...)
NOT-FOR-US: Node @cookiex/deep
-CVE-2021-23441 (All versions of package com.jsoniter:jsoniter are vulnerable
to Deseri ...)
+CVE-2021-23441
+ REJECTED
NOT-FOR-US: com.jsoniter:jsoniter
-CVE-2021-23440 (This affects the package set-value before 4.0.1. A type
confusion vuln ...)
+CVE-2021-23440 (This affects the package set-value before <2.0.1,
>=3.0.0 <4. ...)
- node-set-value 3.0.1-3 (bug #994448)
[bullseye] - node-set-value 3.0.1-2+deb11u1
[buster] - node-set-value <no-dsa> (Minor issue)
@@ -65829,8 +65904,7 @@ CVE-2021-0872
RESERVED
CVE-2021-0871
RESERVED
-CVE-2021-0870
- RESERVED
+CVE-2021-0870 (In RW_SetActivatedTagType of rw_main.cc, there is possible
memory corr ...)
NOT-FOR-US: Android
CVE-2021-0869 (In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a
possible out ...)
NOT-FOR-US: Android
@@ -66154,24 +66228,19 @@ CVE-2021-0710
RESERVED
CVE-2021-0709
RESERVED
-CVE-2021-0708
- RESERVED
+CVE-2021-0708 (In runDumpHeap of ActivityManagerShellCommand.java, there is a
possibl ...)
NOT-FOR-US: Android
CVE-2021-0707
RESERVED
-CVE-2021-0706
- RESERVED
+CVE-2021-0706 (In startListening of PluginManagerImpl.java, there is a
possible way t ...)
NOT-FOR-US: Android
-CVE-2021-0705
- RESERVED
+CVE-2021-0705 (In sanitizeSbn of NotificationManagerService.java, there is a
possible ...)
NOT-FOR-US: Android
CVE-2021-0704
RESERVED
-CVE-2021-0703
- RESERVED
+CVE-2021-0703 (In SecondStageMain of init.cpp, there is a possible use after
free due ...)
NOT-FOR-US: Android
-CVE-2021-0702
- RESERVED
+CVE-2021-0702 (In RevertActiveSessions of apexd.cpp, there is a possible way
to share ...)
NOT-FOR-US: Android
CVE-2021-0701
RESERVED
@@ -66272,11 +66341,9 @@ CVE-2021-0654 (In isRealSnapshot of
TaskThumbnailView.java, there is possible da
NOT-FOR-US: Android
CVE-2021-0653
RESERVED
-CVE-2021-0652
- RESERVED
+CVE-2021-0652 (In VectorDrawable::VectorDrawable of VectorDrawable.java, there
is a p ...)
NOT-FOR-US: Android
-CVE-2021-0651
- RESERVED
+CVE-2021-0651 (In loadLabel of PackageItemInfo.java, there is a possible way
to DoS a ...)
NOT-FOR-US: Android
CVE-2021-0650
RESERVED
@@ -66292,8 +66359,7 @@ CVE-2021-0645 (In shouldBlockFromTree of
ExternalStorageProvider.java, there is
NOT-FOR-US: Android
CVE-2021-0644 (In conditionallyRemoveIdentifiers of
SubscriptionController.java, ther ...)
NOT-FOR-US: Android
-CVE-2021-0643
- RESERVED
+CVE-2021-0643 (In getAllSubInfoList of SubscriptionController.java, there is a
possib ...)
NOT-FOR-US: Android
CVE-2021-0642 (In onResume of VoicemailSettingsFragment.java, there is a
possible way ...)
NOT-FOR-US: Android
@@ -66620,8 +66686,7 @@ CVE-2021-0485 (In getMinimalSize of
PipBoundsAlgorithm.java, there is a possible
NOT-FOR-US: Android
CVE-2021-0484 (In readVector of IMediaPlayer.cpp, there is a possible read of
uniniti ...)
NOT-FOR-US: Android media framework
-CVE-2021-0483
- RESERVED
+CVE-2021-0483 (In multiple methods of AAudioService, there is a possible
use-after-fr ...)
NOT-FOR-US: Android media framework
CVE-2021-0482 (In BinderDiedCallback of MediaCodec.cpp, there is a possible
memory co ...)
NOT-FOR-US: Android media framework
@@ -97896,7 +97961,7 @@ CVE-2020-15013
CVE-2020-15012 (A Directory Traversal issue was discovered in Sonatype Nexus
Repositor ...)
NOT-FOR-US: Sonatype Nexus Repository Manager
CVE-2020-15011 (GNU Mailman before 2.1.33 allows arbitrary content injection
via the C ...)
- {DLA-2276-1 DLA-2265-1}
+ {DSA-4991-1 DLA-2276-1 DLA-2265-1}
- mailman <removed>
NOTE: https://bugs.launchpad.net/mailman/+bug/1877379
NOTE: Fixed by:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1848
@@ -105910,7 +105975,7 @@ CVE-2020-12110 (Certain TP-Link devices have a
Hardcoded Encryption Key. This af
CVE-2020-12109 (Certain TP-Link devices allow Command Injection. This affects
NC200 2. ...)
NOT-FOR-US: TP-Link
CVE-2020-12108 (/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary
Content ...)
- {DLA-2276-1 DLA-2204-1}
+ {DSA-4991-1 DLA-2276-1 DLA-2204-1}
- mailman <removed>
NOTE: https://bugs.launchpad.net/mailman/+bug/1873722
NOTE: Fixed by:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1844
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/beb2ab04d6ef3be0c69446e9e2c552433dfd9369
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/beb2ab04d6ef3be0c69446e9e2c552433dfd9369
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
