Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 2c43dd6e by security tracker role at 2018-01-03T21:10:19+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== --- a/data/CVE/list +++ b/data/CVE/list @@ -1,3 +1,487 @@ +CVE-2018-5078 (Online Ticket Booking has XSS via the admin/eventlist.php cast ...) + TODO: check +CVE-2018-5077 (Online Ticket Booking has XSS via the admin/movieedit.php moviename ...) + TODO: check +CVE-2018-5076 (Online Ticket Booking has XSS via the admin/newsedit.php newstitle ...) + TODO: check +CVE-2018-5075 (Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name ...) + TODO: check +CVE-2018-5074 (Online Ticket Booking has XSS via the admin/manageownerlist.php contact ...) + TODO: check +CVE-2018-5073 (Online Ticket Booking has CSRF via admin/movieedit.php. ...) + TODO: check +CVE-2018-5072 (Online Ticket Booking has XSS via the admin/sitesettings.php keyword ...) + TODO: check +CVE-2018-5071 + RESERVED +CVE-2018-5070 + RESERVED +CVE-2018-5069 + RESERVED +CVE-2018-5068 + RESERVED +CVE-2018-5067 + RESERVED +CVE-2018-5066 + RESERVED +CVE-2018-5065 + RESERVED +CVE-2018-5064 + RESERVED +CVE-2018-5063 + RESERVED +CVE-2018-5062 + RESERVED +CVE-2018-5061 + RESERVED +CVE-2018-5060 + RESERVED +CVE-2018-5059 + RESERVED +CVE-2018-5058 + RESERVED +CVE-2018-5057 + RESERVED +CVE-2018-5056 + RESERVED +CVE-2018-5055 + RESERVED +CVE-2018-5054 + RESERVED +CVE-2018-5053 + RESERVED +CVE-2018-5052 + RESERVED +CVE-2018-5051 + RESERVED +CVE-2018-5050 + RESERVED +CVE-2018-5049 + RESERVED +CVE-2018-5048 + RESERVED +CVE-2018-5047 + RESERVED +CVE-2018-5046 + RESERVED +CVE-2018-5045 + RESERVED +CVE-2018-5044 + RESERVED +CVE-2018-5043 + RESERVED +CVE-2018-5042 + RESERVED +CVE-2018-5041 + RESERVED +CVE-2018-5040 + RESERVED +CVE-2018-5039 + RESERVED +CVE-2018-5038 + RESERVED +CVE-2018-5037 + RESERVED +CVE-2018-5036 + RESERVED +CVE-2018-5035 + RESERVED +CVE-2018-5034 + RESERVED +CVE-2018-5033 + RESERVED +CVE-2018-5032 + RESERVED +CVE-2018-5031 + RESERVED +CVE-2018-5030 + RESERVED +CVE-2018-5029 + RESERVED +CVE-2018-5028 + RESERVED +CVE-2018-5027 + RESERVED +CVE-2018-5026 + RESERVED +CVE-2018-5025 + RESERVED +CVE-2018-5024 + RESERVED +CVE-2018-5023 + RESERVED +CVE-2018-5022 + RESERVED +CVE-2018-5021 + RESERVED +CVE-2018-5020 + RESERVED +CVE-2018-5019 + RESERVED +CVE-2018-5018 + RESERVED +CVE-2018-5017 + RESERVED +CVE-2018-5016 + RESERVED +CVE-2018-5015 + RESERVED +CVE-2018-5014 + RESERVED +CVE-2018-5013 + RESERVED +CVE-2018-5012 + RESERVED +CVE-2018-5011 + RESERVED +CVE-2018-5010 + RESERVED +CVE-2018-5009 + RESERVED +CVE-2018-5008 + RESERVED +CVE-2018-5007 + RESERVED +CVE-2018-5006 + RESERVED +CVE-2018-5005 + RESERVED +CVE-2018-5004 + RESERVED +CVE-2018-5003 + RESERVED +CVE-2018-5002 + RESERVED +CVE-2018-5001 + RESERVED +CVE-2018-5000 + RESERVED +CVE-2018-4999 + RESERVED +CVE-2018-4998 + RESERVED +CVE-2018-4997 + RESERVED +CVE-2018-4996 + RESERVED +CVE-2018-4995 + RESERVED +CVE-2018-4994 + RESERVED +CVE-2018-4993 + RESERVED +CVE-2018-4992 + RESERVED +CVE-2018-4991 + RESERVED +CVE-2018-4990 + RESERVED +CVE-2018-4989 + RESERVED +CVE-2018-4988 + RESERVED +CVE-2018-4987 + RESERVED +CVE-2018-4986 + RESERVED +CVE-2018-4985 + RESERVED +CVE-2018-4984 + RESERVED +CVE-2018-4983 + RESERVED +CVE-2018-4982 + RESERVED +CVE-2018-4981 + RESERVED +CVE-2018-4980 + RESERVED +CVE-2018-4979 + RESERVED +CVE-2018-4978 + RESERVED +CVE-2018-4977 + RESERVED +CVE-2018-4976 + RESERVED +CVE-2018-4975 + RESERVED +CVE-2018-4974 + RESERVED +CVE-2018-4973 + RESERVED +CVE-2018-4972 + RESERVED +CVE-2018-4971 + RESERVED +CVE-2018-4970 + RESERVED +CVE-2018-4969 + RESERVED +CVE-2018-4968 + RESERVED +CVE-2018-4967 + RESERVED +CVE-2018-4966 + RESERVED +CVE-2018-4965 + RESERVED +CVE-2018-4964 + RESERVED +CVE-2018-4963 + RESERVED +CVE-2018-4962 + RESERVED +CVE-2018-4961 + RESERVED +CVE-2018-4960 + RESERVED +CVE-2018-4959 + RESERVED +CVE-2018-4958 + RESERVED +CVE-2018-4957 + RESERVED +CVE-2018-4956 + RESERVED +CVE-2018-4955 + RESERVED +CVE-2018-4954 + RESERVED +CVE-2018-4953 + RESERVED +CVE-2018-4952 + RESERVED +CVE-2018-4951 + RESERVED +CVE-2018-4950 + RESERVED +CVE-2018-4949 + RESERVED +CVE-2018-4948 + RESERVED +CVE-2018-4947 + RESERVED +CVE-2018-4946 + RESERVED +CVE-2018-4945 + RESERVED +CVE-2018-4944 + RESERVED +CVE-2018-4943 + RESERVED +CVE-2018-4942 + RESERVED +CVE-2018-4941 + RESERVED +CVE-2018-4940 + RESERVED +CVE-2018-4939 + RESERVED +CVE-2018-4938 + RESERVED +CVE-2018-4937 + RESERVED +CVE-2018-4936 + RESERVED +CVE-2018-4935 + RESERVED +CVE-2018-4934 + RESERVED +CVE-2018-4933 + RESERVED +CVE-2018-4932 + RESERVED +CVE-2018-4931 + RESERVED +CVE-2018-4930 + RESERVED +CVE-2018-4929 + RESERVED +CVE-2018-4928 + RESERVED +CVE-2018-4927 + RESERVED +CVE-2018-4926 + RESERVED +CVE-2018-4925 + RESERVED +CVE-2018-4924 + RESERVED +CVE-2018-4923 + RESERVED +CVE-2018-4922 + RESERVED +CVE-2018-4921 + RESERVED +CVE-2018-4920 + RESERVED +CVE-2018-4919 + RESERVED +CVE-2018-4918 + RESERVED +CVE-2018-4917 + RESERVED +CVE-2018-4916 + RESERVED +CVE-2018-4915 + RESERVED +CVE-2018-4914 + RESERVED +CVE-2018-4913 + RESERVED +CVE-2018-4912 + RESERVED +CVE-2018-4911 + RESERVED +CVE-2018-4910 + RESERVED +CVE-2018-4909 + RESERVED +CVE-2018-4908 + RESERVED +CVE-2018-4907 + RESERVED +CVE-2018-4906 + RESERVED +CVE-2018-4905 + RESERVED +CVE-2018-4904 + RESERVED +CVE-2018-4903 + RESERVED +CVE-2018-4902 + RESERVED +CVE-2018-4901 + RESERVED +CVE-2018-4900 + RESERVED +CVE-2018-4899 + RESERVED +CVE-2018-4898 + RESERVED +CVE-2018-4897 + RESERVED +CVE-2018-4896 + RESERVED +CVE-2018-4895 + RESERVED +CVE-2018-4894 + RESERVED +CVE-2018-4893 + RESERVED +CVE-2018-4892 + RESERVED +CVE-2018-4891 + RESERVED +CVE-2018-4890 + RESERVED +CVE-2018-4889 + RESERVED +CVE-2018-4888 + RESERVED +CVE-2018-4887 + RESERVED +CVE-2018-4886 + RESERVED +CVE-2018-4885 + RESERVED +CVE-2018-4884 + RESERVED +CVE-2018-4883 + RESERVED +CVE-2018-4882 + RESERVED +CVE-2018-4881 + RESERVED +CVE-2018-4880 + RESERVED +CVE-2018-4879 + RESERVED +CVE-2018-4878 + RESERVED +CVE-2018-4877 + RESERVED +CVE-2018-4876 + RESERVED +CVE-2018-4875 + RESERVED +CVE-2018-4874 + RESERVED +CVE-2018-4873 + RESERVED +CVE-2018-4872 + RESERVED +CVE-2018-4871 + RESERVED +CVE-2018-4870 + RESERVED +CVE-2018-4869 + RESERVED +CVE-2018-4868 (The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 ...) + TODO: check +CVE-2017-1000500 (Keycloak SSO versions prior to 2.x are vulnerable to Host Header ...) + TODO: check +CVE-2017-1000499 (phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a ...) + TODO: check +CVE-2017-1000498 (AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG ...) + TODO: check +CVE-2017-1000497 (Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the ...) + TODO: check +CVE-2017-1000496 (Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration ...) + TODO: check +CVE-2017-1000495 (QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site ...) + TODO: check +CVE-2017-1000494 (Uninitialized stack variable vulnerability in NameValueParserEndElt ...) + TODO: check +CVE-2017-1000490 (Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any ...) + TODO: check +CVE-2017-1000489 (Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow ...) + TODO: check +CVE-2017-1000488 (Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack ...) + TODO: check +CVE-2017-1000487 (Plexus-utils before 3.0.16 is vulnerable to command injection because ...) + TODO: check +CVE-2017-1000486 (Primetek Primefaces 5.x is vulnerable to a weak encryption flaw ...) + TODO: check +CVE-2017-1000485 (Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, ...) + TODO: check +CVE-2017-1000484 (By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an ...) + TODO: check +CVE-2017-1000483 (Accessing private content via str.format in through-the-web templates ...) + TODO: check +CVE-2017-1000482 (A member of the Plone 2.5-5.1rc1 site could set javascript in the ...) + TODO: check +CVE-2017-1000481 (When you visit a page where you need to login, Plone 2.5-5.1rc1 sends ...) + TODO: check +CVE-2017-1000480 (Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when ...) + TODO: check +CVE-2017-1000479 (pfSense versions 2.4.1 and lower are vulnerable to a clickjacking ...) + TODO: check +CVE-2017-1000478 (ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in ...) + TODO: check +CVE-2017-1000477 (XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result ...) + TODO: check +CVE-2017-1000476 (ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in ...) + TODO: check +CVE-2017-1000473 (Linux Dash up to version v2 is vulnerable to multiple command ...) + TODO: check +CVE-2017-1000472 (The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO ...) + TODO: check +CVE-2017-1000471 (EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL ...) + TODO: check +CVE-2017-1000470 (EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable ...) + TODO: check +CVE-2017-1000469 (Cobbler version up to 2.8.2 is vulnerable to a command injection ...) + TODO: check +CVE-2017-1000467 (LavaLite version 5.2.4 is vulnerable to stored cross-site scripting ...) + TODO: check +CVE-2017-1000462 (BookStack version 0.18.4 is vulnerable to stored cross-site scripting, ...) + TODO: check +CVE-2017-1000461 (Brave Software's Brave Browser, version 0.19.73 (and earlier) is ...) + TODO: check +CVE-2017-1000460 (In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), ...) + TODO: check CVE-2018-4867 RESERVED CVE-2018-4866 @@ -8,8 +492,8 @@ CVE-2018-4864 RESERVED CVE-2018-4863 RESERVED -CVE-2018-4862 - RESERVED +CVE-2018-4862 (In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an ...) + TODO: check CVE-2018-4861 RESERVED CVE-2018-4860 @@ -2141,6 +2625,7 @@ CVE-2017-1000458 (Bro before Bro v2.5.2 is vulnerable to an out of bounds write CVE-2017-1000457 (Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal ...) NOT-FOR-US: mojoPortal CVE-2017-1000456 (freedesktop.org libpoppler 0.60.1 fails to validate boundaries in ...) + {DLA-1228-1} - poppler 0.61.1-2 NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=103116 NOTE: Fixed by: https://cgit.freedesktop.org/poppler/poppler/commit/?id=7ee9dadef37b20bca707a6b1e858e17d191e368b @@ -2160,8 +2645,8 @@ CVE-2017-1000450 (In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniCo NOTE: https://github.com/opencv/opencv/issues/9723 NOTE: https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor NOTE: https://github.com/opencv/opencv/pull/9726 -CVE-2017-1000449 (BitThunder 0.9.2 stable is vulnerable to a buffer overflow in ...) - TODO: check +CVE-2017-1000449 + REJECTED CVE-2017-1000448 (Structured Data Linter versions 2.4.1 and older are vulnerable to a ...) TODO: check CVE-2017-1000445 (ImageMagick 7.0.7-1 and older version are vulnerable to null pointer ...) @@ -2341,7 +2826,7 @@ CVE-2017-1000436 REJECTED CVE-2017-1000435 REJECTED -CVE-2017-1000501 [Path traversal flaws] +CVE-2017-1000501 (Awstats version 7.6 and earlier is vulnerable to a path traversal flaw ...) - awstats <unfixed> (bug #885835) NOTE: https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899 NOTE: https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651 @@ -16857,23 +17342,23 @@ CVE-2017-15565 (In Poppler 0.59.0, a NULL Pointer Dereference exists in the ...) NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=103016 NOTE: Fixed by: https://cgit.freedesktop.org/poppler/poppler/commit/?id=19ebd40547186a8ea6da08c8d8e2a6d6b7e84f5d CVE-2017-15564 - RESERVED + REJECTED CVE-2017-15563 - RESERVED + REJECTED CVE-2017-15562 - RESERVED + REJECTED CVE-2017-15561 - RESERVED + REJECTED CVE-2017-15560 - RESERVED + REJECTED CVE-2017-15559 - RESERVED + REJECTED CVE-2017-15558 - RESERVED + REJECTED CVE-2017-15557 - RESERVED + REJECTED CVE-2017-15556 - RESERVED + REJECTED CVE-2017-15555 RESERVED CVE-2017-15554 @@ -16895,17 +17380,17 @@ CVE-2017-15547 CVE-2017-15546 RESERVED CVE-2017-15545 - RESERVED + REJECTED CVE-2017-15544 - RESERVED + REJECTED CVE-2017-15543 - RESERVED + REJECTED CVE-2017-15542 - RESERVED + REJECTED CVE-2017-15541 - RESERVED + REJECTED CVE-2017-15540 - RESERVED + REJECTED CVE-2017-15539 (SQL Injection exists in zorovavi/blog through 2017-10-17 via the id ...) NOT-FOR-US: zorovavi/blog CVE-2017-15587 (An integer overflow was discovered in pdf_read_new_xref_section in ...) @@ -20559,11 +21044,11 @@ CVE-2017-14395 CVE-2017-14394 RESERVED CVE-2017-14393 - RESERVED + REJECTED CVE-2017-14392 - RESERVED + REJECTED CVE-2017-14391 - RESERVED + REJECTED CVE-2017-14390 (In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration ...) NOT-FOR-US: Cloud Foundry CVE-2017-14389 (An issue was discovered in Cloud Foundry Foundation capi-release (all ...) @@ -39206,7 +39691,7 @@ CVE-2017-8051 (Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, conta CVE-2017-8050 (Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web ...) NOT-FOR-US: Tenable Appliance CVE-2017-8049 - RESERVED + REJECTED CVE-2017-8048 (In Cloud Foundry capi-release versions 1.33.0 and later, prior to ...) NOT-FOR-US: Cloud Foundry CVE-2017-8047 (In Cloud Foundry router routing-release all versions prior to v0.163.0 ...) @@ -39218,9 +39703,9 @@ CVE-2017-8045 (In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 CVE-2017-8044 (In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and ...) NOT-FOR-US: Pivotal SSO CVE-2017-8043 - RESERVED + REJECTED CVE-2017-8042 - RESERVED + REJECTED CVE-2017-8041 (In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior ...) NOT-FOR-US: Pivotal CVE-2017-8040 (In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior ...) @@ -39244,18 +39729,18 @@ CVE-2017-8032 (In Cloud Foundry cf-release versions prior to v264; UAA release a CVE-2017-8031 (An issue was discovered in Cloud Foundry Foundation cf-release (all ...) NOT-FOR-US: Cloud Foundry CVE-2017-8030 - RESERVED + REJECTED CVE-2017-8029 - RESERVED + REJECTED CVE-2017-8028 (In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some ...) {DSA-4046-1 DLA-1180-1} - libspring-ldap-java <removed> NOTE: https://pivotal.io/security/cve-2017-8028 NOTE: https://github.com/spring-projects/spring-ldap/issues/430 CVE-2017-8027 - RESERVED + REJECTED CVE-2017-8026 - RESERVED + REJECTED CVE-2017-8025 (RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary ...) NOT-FOR-US: RSA Archer GRC Platform CVE-2017-8024 (EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, ...) @@ -39289,9 +39774,9 @@ CVE-2017-8011 (EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R f CVE-2017-8010 RESERVED CVE-2017-8009 - RESERVED + REJECTED CVE-2017-8008 - RESERVED + REJECTED CVE-2017-8007 (In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS ...) NOT-FOR-US: EMC CVE-2017-8006 (In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a ...) @@ -50097,7 +50582,7 @@ CVE-2017-4995 (An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE CVE-2017-4994 (An issue was discovered in Cloud Foundry Foundation cf-release versions ...) NOT-FOR-US: Cloud Foundry CVE-2017-4993 - RESERVED + REJECTED CVE-2017-4992 (An issue was discovered in Cloud Foundry Foundation cf-release versions ...) NOT-FOR-US: Cloud Foundry CVE-2017-4991 (An issue was discovered in Cloud Foundry Foundation cf-release versions ...) @@ -50147,7 +50632,7 @@ CVE-2017-4970 (An issue was discovered in Cloud Foundry Foundation cf-release v2 CVE-2017-4969 (The Cloud Controller in Cloud Foundry cf-release versions prior to v255 ...) NOT-FOR-US: Cloud Foundry CVE-2017-4968 - RESERVED + REJECTED CVE-2017-4967 (An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x ...) - rabbitmq-server 3.6.10-1 (low; bug #863586) [stretch] - rabbitmq-server <no-dsa> (Minor issue) @@ -50178,11 +50663,11 @@ CVE-2017-4960 (An issue was discovered in Cloud Foundry release v247 through v25 CVE-2017-4959 (An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions ...) NOT-FOR-US: Pivotal PCF Elastic Runtime CVE-2017-4958 - RESERVED + REJECTED CVE-2017-4957 - RESERVED + REJECTED CVE-2017-4956 - RESERVED + REJECTED CVE-2017-4955 (An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions ...) NOT-FOR-US: Pivotal PCF Elastic Runtime CVE-2016-10095 (Stack-based buffer overflow in the _TIFFVGetField function in ...) @@ -56169,17 +56654,17 @@ CVE-2017-2776 CVE-2017-2775 (An exploitable memory corruption vulnerability exists in the ...) NOT-FOR-US: Labview CVE-2017-2774 - RESERVED + REJECTED CVE-2017-2773 (An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions ...) NOT-FOR-US: Pivotal PCF Elastic Runtime CVE-2017-2772 - RESERVED + REJECTED CVE-2017-2771 - RESERVED + REJECTED CVE-2017-2770 - RESERVED + REJECTED CVE-2017-2769 - RESERVED + REJECTED CVE-2017-2768 (EMC Network Configuration Manager (NCM) 9.3.x, EMC Network ...) NOT-FOR-US: EMC Network Configuration Manager CVE-2017-2767 (EMC Network Configuration Manager (NCM) 9.3.x, EMC Network ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2c43dd6e6da9d16af248d9917de48299566c6058 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2c43dd6e6da9d16af248d9917de48299566c6058 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits