Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 8cedc7c1 by security tracker role at 2023-10-11T08:12:13+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,21 @@ +CVE-2023-5511 (Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it ...) + TODO: check +CVE-2023-4990 (Directory traversal vulnerability in MCL-Net versions prior to 4.6 Upd ...) + TODO: check +CVE-2023-45312 (In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for E ...) + TODO: check +CVE-2023-45194 (Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00. ...) + TODO: check +CVE-2023-44997 (Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP For ...) + TODO: check +CVE-2023-44689 (e-Gov Client Application (Windows version) versions prior to 2.1.1.0 a ...) + TODO: check +CVE-2023-37536 (An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remo ...) + TODO: check +CVE-2023-36127 (User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. ...) + TODO: check +CVE-2023-36126 (There is a Cross Site Scripting (XSS) vulnerability in the "theme" par ...) + TODO: check CVE-2023-39325 - golang-1.21 1.21.3-1 - golang-1.20 1.20.10-1 @@ -52,11 +70,13 @@ CVE-2023-4421 NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2238677 NOTE: https://hg.mozilla.org/projects/nss/rev/fc05574c739947d615ab0b2b2b564f01c922eccd CVE-2023-38546 + {DSA-5523-1} - curl 8.3.0-3 NOTE: https://curl.se/docs/CVE-2023-38546.html NOTE: Fixed in https://github.com/curl/curl/commit/61275672b46d9abb32857404 (curl-8_4_0) NOTE: Introduced in https://github.com/curl/curl/commit/74d5a6fb3b9a96d9f CVE-2023-38545 + {DSA-5523-1} - curl 8.3.0-3 [buster] - curl <not-affected> (Vulnerable code not present) NOTE: https://curl.se/docs/CVE-2023-38545.html @@ -96,6 +116,7 @@ CVE-2023-4837 (SmodBIP is vulnerable to Cross-Site Request Forgery, that could b CVE-2023-4309 (Election Services Co. (ESC) Internet Election Service is vulnerable to ...) NOT-FOR-US: Election Services Co. (ESC) Internet Election Service CVE-2023-45648 (Improper Input Validation vulnerability in Apache Tomcat.Tomcatfrom 11 ...) + {DSA-5522-1 DSA-5521-1} - tomcat10 10.1.14-1 - tomcat9 <unfixed> - tomcat8 <removed> @@ -173,6 +194,7 @@ CVE-2023-43485 (When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ CVE-2023-42796 (A vulnerability has been identified in CP-8031 MASTER MODULE (All vers ...) NOT-FOR-US: Siemens CVE-2023-42795 (Incomplete Cleanup vulnerability in Apache Tomcat.When recycling vario ...) + {DSA-5522-1 DSA-5521-1} - tomcat10 10.1.14-1 - tomcat9 <unfixed> - tomcat8 <removed> @@ -505,6 +527,7 @@ CVE-2023-3961 [smbd allows client access to unix domain sockets on the file syst NOTE: https://www.samba.org/samba/security/CVE-2023-3961.html NOTE: In scope for continued Samba support CVE-2023-44487 (The HTTP/2 protocol allows a denial of service (server resource consum ...) + {DSA-5522-1 DSA-5521-1} - tomcat9 <unfixed> - tomcat10 <unfixed> - trafficserver <unfixed> @@ -6894,6 +6917,7 @@ CVE-2023-4524 CVE-2023-41121 (Array AG OS before 9.4.0.499 allows denial of service: remote attacker ...) NOT-FOR-US: Array AG OS CVE-2023-41080 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in F ...) + {DSA-5522-1 DSA-5521-1} - tomcat10 10.1.13-1 - tomcat9 9.0.70-2 [buster] - tomcat9 <postponed> (Minor issue; can be fixed later) @@ -8015,7 +8039,7 @@ CVE-2023-39975 (kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 NOTE: Fixed by: https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840 CVE-2023-39507 (Improper authorization in the custom URL scheme handler in "Rikunabi N ...) NOT-FOR-US: "Rikunabi NEXT" App for Android -CVE-2023-39250 (Dell Storage Integration Tools for VMware (DSITV) 06.01.00.016 contain ...) +CVE-2023-39250 (Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSp ...) NOT-FOR-US: Dell CVE-2023-39115 (install/aiz-uploader/upload in Campcodes Online Matrimonial Website Sy ...) NOT-FOR-US: Campcodes Online Matrimonial Website System @@ -8972,15 +8996,15 @@ CVE-2023-39531 (Sentry is an error tracking and performance monitoring platform. NOT-FOR-US: Sentry CVE-2023-39008 (A command injection vulnerability in the component /api/cron/settings/ ...) NOT-FOR-US: OPNsense -CVE-2023-39007 (/ui/cron/item/open in the Cron component of OPNsense before 23.7 allow ...) +CVE-2023-39007 (/ui/cron/item/open in the Cron component of OPNsense Community Edition ...) NOT-FOR-US: OPNsense -CVE-2023-39006 (The Crash Reporter (crash_reporter.php) component of OPNsense before 2 ...) +CVE-2023-39006 (The Crash Reporter (crash_reporter.php) component of OPNsense Communit ...) NOT-FOR-US: OPNsense -CVE-2023-39005 (Insecure permissions exist for configd.socket in OPNsense before 23.7.) +CVE-2023-39005 (Insecure permissions exist for configd.socket in OPNsense Community Ed ...) NOT-FOR-US: OPNsense CVE-2023-39004 (Insecure permissions in the configuration directory (/conf/) of OPNsen ...) NOT-FOR-US: OPNsense -CVE-2023-39003 (OPNsense before 23.7 was discovered to contain insecure permissions in ...) +CVE-2023-39003 (OPNsense Community Edition before 23.7 and Business Edition before 23. ...) NOT-FOR-US: OPNsense CVE-2023-39002 (A cross-site scripting (XSS) vulnerability in the act parameter of sys ...) NOT-FOR-US: OPNsense @@ -8990,7 +9014,7 @@ CVE-2023-39000 (A reflected cross-site scripting (XSS) vulnerability in the comp NOT-FOR-US: OPNsense CVE-2023-38999 (A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/ha ...) NOT-FOR-US: OPNsense -CVE-2023-38998 (An open redirect in the Login page of OPNsense before 23.7 allows atta ...) +CVE-2023-38998 (An open redirect in the Login page of OPNsense Community Edition befor ...) NOT-FOR-US: OPNsense CVE-2023-38997 (A directory traversal vulnerability in the Captive Portal templates of ...) NOT-FOR-US: OPNsense @@ -28368,6 +28392,7 @@ CVE-2023-1553 CVE-2023-1552 (ToolboxST prior to version 7.10 is affected by a deserialization vulne ...) NOT-FOR-US: ToolboxST CVE-2023-28709 (The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 ...) + {DSA-5521-1} [experimental] - tomcat10 10.1.8-1 - tomcat10 10.1.10-1 - tomcat9 <not-affected> (Incomplete fix for CVE-2023-24998 not applied) @@ -35523,12 +35548,12 @@ CVE-2023-26322 RESERVED CVE-2023-26321 RESERVED -CVE-2023-26320 - RESERVED -CVE-2023-26319 - RESERVED -CVE-2023-26318 - RESERVED +CVE-2023-26320 (Improper Neutralization of Special Elements used in a Command ('Comman ...) + TODO: check +CVE-2023-26319 (Improper Neutralization of Special Elements used in a Command ('Comman ...) + TODO: check +CVE-2023-26318 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') ...) + TODO: check CVE-2023-26317 (A vulnerability has been discovered in Xiaomi routers that could allow ...) NOT-FOR-US: Xiaomi CVE-2023-26316 (A XSS vulnerability exists in the Xiaomi cloud service Application pro ...) @@ -35842,8 +35867,8 @@ CVE-2023-26222 RESERVED CVE-2023-26221 RESERVED -CVE-2023-26220 - RESERVED +CVE-2023-26220 (The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analy ...) + TODO: check CVE-2023-26219 RESERVED CVE-2023-26218 (The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contain ...) @@ -39792,6 +39817,7 @@ CVE-2023-25000 (HashiCorp Vault's implementation of Shamir's secret sharing used CVE-2023-24999 (HashiCorp Vault and Vault Enterprise\u2019s approle auth method allowe ...) NOT-FOR-US: Vault CVE-2023-24998 (Apache Commons FileUpload before 1.5 does not limit the number of requ ...) + {DSA-5522-1} - tomcat10 10.1.5-1 - tomcat9 9.0.70-2 [bullseye] - tomcat9 <postponed> (Minor issue, fix along with future update) @@ -60321,10 +60347,10 @@ CVE-2022-44760 RESERVED CVE-2022-44759 RESERVED -CVE-2022-44758 - RESERVED -CVE-2022-44757 - RESERVED +CVE-2022-44758 (BigFix Insights/IVR fixlet uses improper credential handling within ce ...) + TODO: check +CVE-2022-44757 (BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptogr ...) + TODO: check CVE-2022-44756 (Insights for Vulnerability Remediation (IVR) is vulnerable toimproper ...) NOT-FOR-US: HCL CVE-2022-44755 (HCL Notes is susceptible to a stack based buffer overflow vulnerabilit ...) @@ -69656,8 +69682,8 @@ CVE-2022-42453 (There are insufficient warnings when a Fixlet is imported by a u NOT-FOR-US: HCL CVE-2022-42452 (HCL Launch is vulnerable to HTML injection. HTML code is stored and in ...) NOT-FOR-US: HCL -CVE-2022-42451 - RESERVED +CVE-2022-42451 (Certain credentials within the BigFix Patch Management Download Plug-i ...) + TODO: check CVE-2022-42450 RESERVED CVE-2022-42449 @@ -112572,7 +112598,7 @@ CVE-2022-27213 (Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not NOT-FOR-US: Jenkins plugin CVE-2022-27212 (Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not ...) NOT-FOR-US: Jenkins plugin -CVE-2022-27211 (A missing/An incorrect permission check in Jenkins Kubernetes Continuo ...) +CVE-2022-27211 (A missing permission check in Jenkins Kubernetes Continuous Deploy Plu ...) NOT-FOR-US: Jenkins plugin CVE-2022-27210 (A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernete ...) NOT-FOR-US: Jenkins plugin View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cedc7c179f9a2365c4e41118fd21209b4663219 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cedc7c179f9a2365c4e41118fd21209b4663219 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits