Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8f5447c6 by security tracker role at 2023-07-10T08:12:25+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,13 @@
+CVE-2023-3568 (Improper Input Validation in GitHub repository
fossbilling/fossbilling ...)
+ TODO: check
+CVE-2023-37288 (SmartBPM.NET component has a vulnerability of path traversal
within it ...)
+ TODO: check
+CVE-2023-37287 (SmartBPM.NET has a vulnerability of using hard-coded
authentication ke ...)
+ TODO: check
+CVE-2023-37286 (SmartSoft SmartBPM.NET has a vulnerability of using hard-coded
machine ...)
+ TODO: check
+CVE-2021-4406 (An administrator is able to execute commands as root via the
alerts ma ...)
+ TODO: check
CVE-2023-3045 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: Tise Technology Parking Web Report
CVE-2023-36935
@@ -7640,8 +7650,8 @@ CVE-2023-2235 (A use-after-free vulnerability in the
Linux Kernel Performance Ev
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE:
https://git.kernel.org/linus/fd0815f632c24878e325821943edccc7fde947a2 (6.3-rc3)
-CVE-2023-2234
- RESERVED
+CVE-2023-2234 (Union variant confusion allows any malicious BT controller to
execute ...)
+ TODO: check
CVE-2023-2233
RESERVED
CVE-2023-2232 (An issue has been discovered in GitLab affecting all versions
starting ...)
@@ -9454,8 +9464,8 @@ CVE-2023-30444 (IBM Watson Machine Learning on Cloud Pak
for Data 4.0 and 4.5 is
NOT-FOR-US: IBM
CVE-2023-30443
RESERVED
-CVE-2023-30442
- RESERVED
+CVE-2023-30442 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 11.1 ...)
+ TODO: check
CVE-2023-30441 (IBM Runtime Environment, Java Technology Edition IBMJCEPlus
and JSSE 8 ...)
NOT-FOR-US: IBM
CVE-2023-30440 (IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00
through FW9 ...)
@@ -9476,8 +9486,8 @@ CVE-2023-30433
RESERVED
CVE-2023-30432
RESERVED
-CVE-2023-30431
- RESERVED
+CVE-2023-30431 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 10.5 ...)
+ TODO: check
CVE-2023-30430
RESERVED
CVE-2015-10100 (A vulnerability, which was classified as critical, has been
found in D ...)
@@ -12011,10 +12021,10 @@ CVE-2023-1904
RESERVED
CVE-2023-1903 (SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not
perform ...)
NOT-FOR-US: SAP
-CVE-2023-1902
- RESERVED
-CVE-2023-1901
- RESERVED
+CVE-2023-1902 (The bluetooth HCI host layer logic not clearing a global
reference to ...)
+ TODO: check
+CVE-2023-1901 (The bluetooth HCI host layer logic not clearing a global
reference to ...)
+ TODO: check
CVE-2023-1900 (A vulnerability within the Avira network protection feature
allowed an ...)
NOT-FOR-US: Norton
CVE-2023-1899 (Atlas Copco Power Focus 6000 web server is not a secure
connection by ...)
@@ -12473,8 +12483,8 @@ CVE-2023-29258
RESERVED
CVE-2023-29257 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 10.5 ...)
NOT-FOR-US: IBM
-CVE-2023-29256
- RESERVED
+CVE-2023-29256 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 10.5 ...)
+ TODO: check
CVE-2023-29255 (IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 10.5 ...)
NOT-FOR-US: IBM
CVE-2023-29254
@@ -13464,18 +13474,18 @@ CVE-2021-46879 (An issue was discovered in Treasure
Data Fluent Bit 1.7.1, a wro
NOT-FOR-US: Treasure Data Fluent Bit
CVE-2021-46878 (An issue was discovered in Treasure Data Fluent Bit 1.7.1,
erroneous p ...)
NOT-FOR-US: Treasure Data Fluent Bit
-CVE-2023-28958
- RESERVED
+CVE-2023-28958 (IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is
potentially ...)
+ TODO: check
CVE-2023-28957
RESERVED
CVE-2023-28956 (IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through
8.1.17.2 ma ...)
NOT-FOR-US: IBM
-CVE-2023-28955
- RESERVED
+CVE-2023-28955 (IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could
allow an ...)
+ TODO: check
CVE-2023-28954
RESERVED
-CVE-2023-28953
- RESERVED
+CVE-2023-28953 (IBM Cognos Analytics on Cloud Pak for Data 4.0 could allow an
attacker ...)
+ TODO: check
CVE-2023-28952
RESERVED
CVE-2023-28951
@@ -18360,8 +18370,8 @@ CVE-2023-27560 (Math/PrimeField.php in phpseclib 3.x
before 3.0.19 has an infini
NOTE: Fixed by:
https://github.com/phpseclib/phpseclib/commit/6298d1cd55c3ffa44533bd41906caec246b60440
(3.0.19)
CVE-2023-27559 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 10.5 ...)
NOT-FOR-US: IBM
-CVE-2023-27558
- RESERVED
+CVE-2023-27558 (IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a
privile ...)
+ TODO: check
CVE-2023-27557 (IBM Counter Fraud Management for Safer Payments 6.1.0.00
through 6.1.1 ...)
NOT-FOR-US: IBM
CVE-2023-27556 (IBM Counter Fraud Management for Safer Payments 6.1.0.00,
6.2.0.00, 6. ...)
@@ -18396,8 +18406,8 @@ CVE-2023-27542
RESERVED
CVE-2023-27541
RESERVED
-CVE-2023-27540
- RESERVED
+CVE-2023-27540 (IBM Watson CP4D Data Stores 4.6.0 does not properly allocate
resources ...)
+ TODO: check
CVE-2023-1165 (A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It
has been ...)
NOT-FOR-US: Zhong Bang CRMEB Java
CVE-2023-1164 (A vulnerability was found in KylinSoft kylin-activation and
classified ...)
@@ -29366,8 +29376,8 @@ CVE-2023-0361 (A timing side-channel in the handling of
RSA ClientKeyExchange me
NOTE: Code cleanup:
https://gitlab.com/gnutls/gnutls/-/commit/4b7ff428291c7ed77c6d2635577c83a43bbae558
(3.8.0)
CVE-2023-0360 (The Location Weather WordPress plugin before 1.3.4 does not
validate a ...)
NOT-FOR-US: WordPress plugin
-CVE-2023-0359
- RESERVED
+CVE-2023-0359 (A missing nullptr-check in handle_ra_input can cause a
nullptr-deref.)
+ TODO: check
CVE-2023-0358 (Use After Free in GitHub repository gpac/gpac prior to
2.3.0-DEV.)
- gpac <unfixed> (bug #1033116)
[bullseye] - gpac <no-dsa> (Minor issue)
@@ -30339,8 +30349,8 @@ CVE-2023-23489 (The Easy Digital Downloads WordPress
Plugin, versions 3.1.0.2 &
NOT-FOR-US: WordPress plugin
CVE-2023-23488 (The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is
affecte ...)
NOT-FOR-US: WordPress plugin
-CVE-2023-23487
- RESERVED
+CVE-2023-23487 (IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect
Server) 11.1 ...)
+ TODO: check
CVE-2023-23486
RESERVED
CVE-2023-23485
@@ -44785,7 +44795,7 @@ CVE-2022-45201
RESERVED
CVE-2022-45200
RESERVED
-CVE-2022-3993 (Missing Authorization in GitHub repository kareadita/kavita
prior to 0 ...)
+CVE-2022-3993 (Improper Restriction of Excessive Authentication Attempts in
GitHub re ...)
NOT-FOR-US: Kavita
CVE-2022-3992 (A vulnerability classified as problematic was found in
SourceCodester ...)
NOT-FOR-US: SourceCodester Sanitization Management System
@@ -66404,7 +66414,7 @@ CVE-2022-2847 (A vulnerability, which was classified as
critical, has been found
NOT-FOR-US: SourceCodester Guest Management System
CVE-2022-2846 (The Calendar Event Multi View WordPress plugin before 1.4.07
does not ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-2845 (Buffer Over-read in GitHub repository vim/vim prior to
9.0.0218.)
+CVE-2022-2845 (Improper Validation of Specified Quantity in Input in GitHub
repositor ...)
- vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445
NOTE:
https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c
(v9.0.0218)
@@ -66585,7 +66595,7 @@ CVE-2022-36403 (Untrusted search path vulnerability in
the installer of Device S
NOT-FOR-US: Ricoh
CVE-2022-2825 (This vulnerability allows remote attackers to execute arbitrary
code o ...)
NOT-FOR-US: PTC
-CVE-2022-2824 (Improper Access Control in GitHub repository openemr/openemr
prior to ...)
+CVE-2022-2824 (Authorization Bypass Through User-Controlled Key in GitHub
repository ...)
NOT-FOR-US: OpenEMR
CVE-2022-2823 (The Slider, Gallery, and Carousel by MetaSlider WordPress
plugin befor ...)
NOT-FOR-US: WordPress plugin
@@ -66593,7 +66603,7 @@ CVE-2022-2822 (An attacker can freely brute force
username and password and can
- octoprint <itp> (bug #718591)
CVE-2022-2821 (Missing Critical Step in Authentication in GitHub repository
namelessm ...)
NOT-FOR-US: NamelessMC/Nameless
-CVE-2022-2820 (Improper Access Control in GitHub repository
namelessmc/nameless prior ...)
+CVE-2022-2820 (Session Fixation in GitHub repository namelessmc/nameless prior
to v2. ...)
NOT-FOR-US: NamelessMC/Nameless
CVE-2022-2819 (Heap-based Buffer Overflow in GitHub repository vim/vim prior
to 9.0.0 ...)
- vim 2:9.0.0229-1 (unimportant)
@@ -73665,7 +73675,7 @@ CVE-2022-2370 (The YaySMTP WordPress plugin before
2.2.1 does not have capabilit
NOT-FOR-US: WordPress plugin
CVE-2022-2369 (The YaySMTP WordPress plugin before 2.2.1 does not have
capability che ...)
NOT-FOR-US: WordPress plugin
-CVE-2022-2368 (Business Logic Errors in GitHub repository
microweber/microweber prior ...)
+CVE-2022-2368 (Authentication Bypass by Spoofing in GitHub repository
microweber/micr ...)
NOT-FOR-US: microweber
CVE-2022-2367 (The WSM Downloader WordPress plugin through 1.4.0 allows only
specific ...)
NOT-FOR-US: WordPress plugin
@@ -105672,7 +105682,7 @@ CVE-2022-24667 (A program using swift-nio-http2 is
vulnerable to a denial of ser
NOT-FOR-US: swift-nio-http2
CVE-2022-24666 (A program using swift-nio-http2 is vulnerable to a denial of
service a ...)
NOT-FOR-US: swift-nio-http2
-CVE-2022-0528 (Exposure of Sensitive Information to an Unauthorized Actor in
GitHub r ...)
+CVE-2022-0528 (Server-Side Request Forgery (SSRF) in GitHub repository
transloadit/up ...)
NOT-FOR-US: Node uppy
CVE-2022-0527 (Cross-site Scripting (XSS) - Stored in GitHub repository
chatwoot/chat ...)
NOT-FOR-US: chatwoot
@@ -130516,16 +130526,16 @@ CVE-2021-42084 (An issue was discovered in Zammad
before 4.1.1. An attacker with
- zammad <itp> (bug #841355)
CVE-2021-3869 (corenlp is vulnerable to Improper Restriction of XML External
Entity R ...)
NOT-FOR-US: CoreNLP
-CVE-2021-42083
- RESERVED
-CVE-2021-42082
- RESERVED
-CVE-2021-42081
- RESERVED
-CVE-2021-42080
- RESERVED
-CVE-2021-42079
- RESERVED
+CVE-2021-42083 (An authenticated attacker is able to create alerts that
trigger a stor ...)
+ TODO: check
+CVE-2021-42082 (Local users are able to execute scripts under root privileges.)
+ TODO: check
+CVE-2021-42081 (An authenticated administrator is allowed to remotely execute
arbitrar ...)
+ TODO: check
+CVE-2021-42080 (An attacker is able to launch a Reflected XSS attack using a
crafted U ...)
+ TODO: check
+CVE-2021-42079 (An authenticated administrator is able to prepare an alert
that is abl ...)
+ TODO: check
CVE-2021-42078 (PHP Event Calendar through 2021-11-04 allows persistent
cross-site scr ...)
NOT-FOR-US: PHP Event Calendar
CVE-2021-42077 (PHP Event Calendar before 2021-09-03 allows SQL injection, as
demonstr ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8f5447c6c44b02571b9d5ecf156681eb9bcee6fe
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8f5447c6c44b02571b9d5ecf156681eb9bcee6fe
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
