[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Mar 18 08:10:21 GMT 2022 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2e993028 by security tracker role at 2022-03-18T08:10:13+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,29 @@
+CVE-2022-27240 (scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer ...)
+	TODO: check
+CVE-2022-27239
+	RESERVED
+CVE-2022-27238
+	RESERVED
+CVE-2022-27237
+	RESERVED
+CVE-2022-27236
+	RESERVED
+CVE-2022-26887
+	RESERVED
+CVE-2022-26667
+	RESERVED
+CVE-2022-26666
+	RESERVED
+CVE-2022-26514
+	RESERVED
+CVE-2022-26349
+	RESERVED
+CVE-2022-25880
+	RESERVED
+CVE-2022-1019
+	RESERVED
+CVE-2022-1018
+	RESERVED
 CVE-2022-27172
 	RESERVED
 CVE-2022-1017
@@ -165,8 +191,7 @@ CVE-2022-27193 (CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entit
 	TODO: check
 CVE-2022-27192
 	RESERVED
-CVE-2022-27191
-	RESERVED
+CVE-2022-27191 (golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b in Go ...)
 	- golang-go.crypto 1:0.0~git20220315.3147a52-1
 	NOTE: https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ
 	NOTE: https://github.com/golang/crypto/commit/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d
@@ -816,8 +841,8 @@ CVE-2022-26966 (An issue was discovered in the Linux kernel before 5.16.12. driv
 	[bullseye] - linux 5.10.103-1
 	[buster] - linux 4.19.232-1
 	NOTE: https://git.kernel.org/linus/e9da0b56fe27206b49f39805f7dcda8a89379062 (5.17-rc6)
-CVE-2022-26965
-	RESERVED
+CVE-2022-26965 (In Pluck 4.7.16, an admin user can use the theme upload functionality  ...)
+	TODO: check
 CVE-2022-26964
 	RESERVED
 CVE-2022-26963
@@ -1909,16 +1934,16 @@ CVE-2022-26505 (A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1
 	[buster] - minidlna <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/minidlna/git/ci/c21208508dbc131712281ec5340687e5ae89e940/
 	NOTE: https://www.openwall.com/lists/oss-security/2022/03/03/1
-CVE-2022-26504
-	RESERVED
+CVE-2022-26504 (Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4 ...)
+	TODO: check
 CVE-2022-26503 (Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, ...)
 	NOT-FOR-US: Veeam
 CVE-2022-26502
 	RESERVED
-CVE-2022-26501
-	RESERVED
-CVE-2022-26500
-	RESERVED
+CVE-2022-26501 (Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4 ...)
+	TODO: check
+CVE-2022-26500 (Improper limitation of path names in Veeam Backup & Replication 9. ...)
+	TODO: check
 CVE-2022-26499
 	RESERVED
 CVE-2022-26498
@@ -3703,10 +3728,10 @@ CVE-2022-21126
 	RESERVED
 CVE-2022-21122
 	RESERVED
-CVE-2022-0758
-	RESERVED
-CVE-2022-0757
-	RESERVED
+CVE-2022-0758 (Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cr ...)
+	TODO: check
+CVE-2022-0757 (Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL I ...)
+	TODO: check
 CVE-2022-0756 (Improper Authorization in GitHub repository salesagility/suitecrm prio ...)
 	NOT-FOR-US: SuiteCRM
 CVE-2022-0755 (Improper Access Control in GitHub repository salesagility/suitecrm pri ...)
@@ -6614,8 +6639,8 @@ CVE-2022-24772
 	RESERVED
 CVE-2022-24771
 	RESERVED
-CVE-2022-24770
-	RESERVED
+CVE-2022-24770 (`gradio` is an open source framework for building interactive machine  ...)
+	TODO: check
 CVE-2022-24769
 	RESERVED
 CVE-2022-24768
@@ -7989,8 +8014,8 @@ CVE-2022-24303
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2052682
 	NOTE: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
 	NOTE: https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26 (9.0.1)
-CVE-2022-24302
-	RESERVED
+CVE-2022-24302 (In Paramiko before 2.10.1, a race condition (between creation and chmo ...)
+	TODO: check
 CVE-2022-24296
 	RESERVED
 CVE-2022-24295 (Okta Advanced Server Access Client for Windows prior to version 1.57.0 ...)
@@ -12105,8 +12130,8 @@ CVE-2022-23220 (USBView 2.1 before 2.2 allows some local users (e.g., ones logge
 	NOTE: Introduced by: https://github.com/gregkh/usbview/commit/ddefeba3f67d6a6f394eb57352254c1c8a312671 (v2.1)
 	NOTE: Fixed by: https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b (v2.2)
 	NOTE: Hardening: https://github.com/gregkh/usbview/commit/1282782301570b3ee27f82f4f34c2c1a82bfd91a (v2.2)
-CVE-2022-0237
-	RESERVED
+CVE-2022-0237 (Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privi ...)
+	TODO: check
 CVE-2022-0236 (The WP Import Export WordPress plugin (both free and premium versions) ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-0235 (node-fetch is vulnerable to Exposure of Sensitive Information to an Un ...)
@@ -15259,8 +15284,8 @@ CVE-2021-46109 (Invalid input sanitizing leads to reflected Cross Site Scripting
 	NOT-FOR-US: ASUS
 CVE-2021-46108 (D-Link DSL-2730E CT-20131125 devices allow XSS via the username parame ...)
 	NOT-FOR-US: D-Link
-CVE-2021-46107
-	RESERVED
+CVE-2021-46107 (Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server S ...)
+	TODO: check
 CVE-2021-46106
 	RESERVED
 CVE-2021-46105
@@ -15633,12 +15658,12 @@ CVE-2021-45970 (An issue was discovered in IdeBusDxe in Insyde InsydeH2O with ke
 	NOT-FOR-US: Insyde
 CVE-2021-45969 (An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel  ...)
 	NOT-FOR-US: Insyde
-CVE-2021-45968
-	RESERVED
-CVE-2021-45967
-	RESERVED
-CVE-2021-45966
-	RESERVED
+CVE-2021-45968 (An issue was discovered in xmppserver jar in the XMPP Server component ...)
+	TODO: check
+CVE-2021-45967 (An issue was discovered in Pascom Cloud Phone System before 7.20.x. A  ...)
+	TODO: check
+CVE-2021-45966 (An issue was discovered in Pascom Cloud Phone System before 7.20.x. In ...)
+	TODO: check
 CVE-2021-45965
 	RESERVED
 CVE-2021-45964
@@ -16241,8 +16266,8 @@ CVE-2021-45870
 	RESERVED
 CVE-2021-45869
 	RESERVED
-CVE-2021-45868
-	RESERVED
+CVE-2021-45868 (In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not vali ...)
+	TODO: check
 CVE-2021-45867
 	RESERVED
 CVE-2021-45866
@@ -19322,8 +19347,8 @@ CVE-2021-4108 (snipe-it is vulnerable to Improper Neutralization of Input During
 	NOT-FOR-US: snipe-it
 CVE-2022-0010
 	RESERVED
-CVE-2021-45040
-	RESERVED
+CVE-2021-45040 (The Spatie media-library-pro library through 1.17.10 and 2.x through 2 ...)
+	TODO: check
 CVE-2021-45039
 	RESERVED
 CVE-2021-45038 (An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36 ...)
@@ -19648,8 +19673,8 @@ CVE-2021-44909
 	RESERVED
 CVE-2021-44908 (SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via c ...)
 	TODO: check
-CVE-2021-44907
-	RESERVED
+CVE-2021-44907 (A Denial of Service vulnerability exists in qs up to 6.8.0 due to insu ...)
+	TODO: check
 CVE-2021-44906 (Minimist <=1.2.5 is vulnerable to Prototype Pollution via file inde ...)
 	TODO: check
 CVE-2021-44905
@@ -19990,8 +20015,8 @@ CVE-2021-4097 (phpservermon is vulnerable to Improper Neutralization of CRLF Seq
 	NOT-FOR-US: phpservermon
 CVE-2021-4096
 	RESERVED
-CVE-2022-21822
-	RESERVED
+CVE-2022-21822 (NVIDIA FLARE contains a vulnerability in the admin interface, where an ...)
+	TODO: check
 CVE-2022-21821
 	RESERVED
 CVE-2022-21820
@@ -22211,10 +22236,10 @@ CVE-2021-44090 (An SQL Injection vulnerability exists in Sourcecodester Online R
 	NOT-FOR-US: Sourcecodester Online Reviewer System
 CVE-2021-44089
 	RESERVED
-CVE-2021-44088
-	RESERVED
-CVE-2021-44087
-	RESERVED
+CVE-2021-44088 (An SQL Injection vulnerability exists in Sourcecodester Attendance and ...)
+	TODO: check
+CVE-2021-44087 (A Remote Code Execution (RCE) vulnerability exists in Sourcecodester A ...)
+	TODO: check
 CVE-2021-44086
 	RESERVED
 CVE-2021-44085
@@ -22615,8 +22640,8 @@ CVE-2021-43963 (An issue was discovered in Couchbase Sync Gateway 2.7.0 through
 	NOT-FOR-US: Couchbase Sync Gateway
 CVE-2021-43962
 	RESERVED
-CVE-2021-43961
-	RESERVED
+CVE-2021-43961 (Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. ...)
+	TODO: check
 CVE-2021-43960 (** DISPUTED ** Lorensbergs Connect2 3.13.7647.20190 is affected by an  ...)
 	NOT-FOR-US: Lorensbergs Connect2
 CVE-2021-3974 (vim is vulnerable to Use After Free ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e9930288d4e504c9e6c8004f14b348137cc9cf7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e9930288d4e504c9e6c8004f14b348137cc9cf7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220318/91c38b4e/attachment.htm>

More information about the debian-security-tracker-commits mailing list