[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Mon May 30 21:10:35 BST 2022 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6bbdf8b0 by security tracker role at 2022-05-30T20:10:26+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,49 @@
+CVE-2022-31813
+	RESERVED
+CVE-2022-31812
+	RESERVED
+CVE-2022-31811
+	RESERVED
+CVE-2022-31810
+	RESERVED
+CVE-2022-31809
+	RESERVED
+CVE-2022-31808
+	RESERVED
+CVE-2022-31807
+	RESERVED
+CVE-2022-31806
+	RESERVED
+CVE-2022-31805
+	RESERVED
+CVE-2022-31804
+	RESERVED
+CVE-2022-31803
+	RESERVED
+CVE-2022-31802
+	RESERVED
+CVE-2022-31801
+	RESERVED
+CVE-2022-31800
+	RESERVED
+CVE-2022-1945
+	RESERVED
+CVE-2022-1944
+	RESERVED
+CVE-2022-1943
+	RESERVED
+CVE-2022-1942
+	RESERVED
+CVE-2022-1941
+	RESERVED
+CVE-2022-1940
+	RESERVED
+CVE-2022-1939
+	RESERVED
+CVE-2022-1938
+	RESERVED
+CVE-2022-1937
+	RESERVED
 CVE-2022-XXXX [Sanitizing and other XSS protections]
 	- spip 4.1.2+dfsg-1
 	[bullseye] - spip 3.2.11-3+deb11u4
@@ -3549,14 +3595,14 @@ CVE-2022-30526
 	RESERVED
 CVE-2022-30525 (A OS command injection vulnerability in the CGI program of Zyxel USG F ...)
 	NOT-FOR-US: Zyxel
-CVE-2022-1646
-	RESERVED
-CVE-2022-1645
-	RESERVED
-CVE-2022-1644
-	RESERVED
-CVE-2022-1643
-	RESERVED
+CVE-2022-1646 (The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sa ...)
+	TODO: check
+CVE-2022-1645 (The Amazon Link WordPress plugin through 3.2.10 does not sanitise and  ...)
+	TODO: check
+CVE-2022-1644 (The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not s ...)
+	TODO: check
+CVE-2022-1643 (The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise ...)
+	TODO: check
 CVE-2022-30524 (There is an invalid memory access in the TextLine class in TextOutputD ...)
 	- xpdf <not-affected> (Debian uses poppler, which is not affected)
 CVE-2022-30523 (Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below i ...)
@@ -4166,8 +4212,8 @@ CVE-2022-1613
 	RESERVED
 CVE-2022-1612
 	RESERVED
-CVE-2022-1611
-	RESERVED
+CVE-2022-1611 (The Bulk Page Creator WordPress plugin before 1.1.4 does not protect i ...)
+	TODO: check
 CVE-2022-1610
 	RESERVED
 CVE-2022-1609
@@ -4225,8 +4271,8 @@ CVE-2022-1591
 	RESERVED
 CVE-2022-1590 (A vulnerability was found in Bludit 3.13.1. It has been declared as pr ...)
 	NOT-FOR-US: Bludit
-CVE-2022-1589
-	RESERVED
+CVE-2022-1589 (The Change wp-admin login WordPress plugin before 1.1.0 does not prope ...)
+	TODO: check
 CVE-2022-30292 (thread_call in sqbaselib.cpp in SQUIRREL 3.2 lacks a certain sq_reserv ...)
 	- squirrel3 <unfixed>
 	[bullseye] - squirrel3 <no-dsa> (Minor issue)
@@ -4377,10 +4423,10 @@ CVE-2022-30228
 	RESERVED
 CVE-2022-1584 (Reflected XSS in GitHub repository microweber/microweber prior to 1.2. ...)
 	NOT-FOR-US: microweber
-CVE-2022-1583
-	RESERVED
-CVE-2022-1582
-	RESERVED
+CVE-2022-1583 (The External Links in New Window / New Tab WordPress plugin before 1.4 ...)
+	TODO: check
+CVE-2022-1582 (The External Links in New Window / New Tab WordPress plugin before 1.4 ...)
+	TODO: check
 CVE-2022-1581
 	RESERVED
 CVE-2022-1580
@@ -4407,8 +4453,8 @@ CVE-2022-1570
 	RESERVED
 CVE-2022-1569
 	RESERVED
-CVE-2022-1568
-	RESERVED
+CVE-2022-1568 (The Team Members WordPress plugin before 5.1.1 does not escape some of ...)
+	TODO: check
 CVE-2021-46810
 	RESERVED
 CVE-2021-46809
@@ -4653,19 +4699,19 @@ CVE-2022-30127
 	RESERVED
 CVE-2022-1567 (The WP-JS plugin for WordPress contains a script called wp-js.php with ...)
 	NOT-FOR-US: WP-JS plugin for WordPress
-CVE-2022-1566
-	RESERVED
+CVE-2022-1566 (The Quotes llama WordPress plugin through 0.7 does not sanitise and es ...)
+	TODO: check
 CVE-2022-1565
 	RESERVED
-CVE-2022-1564
-	RESERVED
+CVE-2022-1564 (The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanit ...)
+	TODO: check
 CVE-2022-1563
 	RESERVED
-CVE-2022-1562
-	RESERVED
+CVE-2022-1562 (The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploade ...)
+	TODO: check
 CVE-2022-1561
 	RESERVED
-CVE-2022-1560 (The Amministrazione Aperta WordPress plugin through 3.7.3 does not val ...)
+CVE-2022-1560 (The Amministrazione Aperta WordPress plugin before 3.8 does not valida ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-1559 (The Clipr WordPress plugin through 1.2.3 does not sanitise and escape  ...)
 	NOT-FOR-US: WordPress plugin
@@ -4673,8 +4719,8 @@ CVE-2022-1558 (The Curtain WordPress plugin through 1.0.2 does not sanitise and
 	NOT-FOR-US: WordPress plugin
 CVE-2022-1557 (The ULeak Security & Monitoring WordPress plugin through 1.2.3 doe ...)
 	NOT-FOR-US: WordPress plugin
-CVE-2022-1556
-	RESERVED
+CVE-2022-1556 (The StaffList WordPress plugin before 3.1.5 does not properly sanitise ...)
+	TODO: check
 CVE-2022-1555 (DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/micro ...)
 	NOT-FOR-US: microweber
 CVE-2022-1554 (Path Traversal due to `send_file` call in GitHub repository clinical-g ...)
@@ -5231,8 +5277,8 @@ CVE-2022-29490
 	RESERVED
 CVE-2022-1543 (Improper handling of Length parameter in GitHub repository erudika/sco ...)
 	NOT-FOR-US: scoold
-CVE-2022-1542
-	RESERVED
+CVE-2022-1542 (The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and ...)
+	TODO: check
 CVE-2022-1541
 	RESERVED
 CVE-2022-1540
@@ -5270,10 +5316,10 @@ CVE-2022-1529
 	- firefox-esr 91.9.1esr-1
 	- thunderbird <unfixed>
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/#CVE-2022-1529
-CVE-2022-1528
-	RESERVED
-CVE-2022-1527
-	RESERVED
+CVE-2022-1528 (The VikBooking Hotel Booking Engine & PMS WordPress plugin before  ...)
+	TODO: check
+CVE-2022-1527 (The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape  ...)
+	TODO: check
 CVE-2021-4227
 	RESERVED
 CVE-2022-29908
@@ -5813,8 +5859,8 @@ CVE-2022-1458 (Stored XSS Leads To Session Hijacking in GitHub repository openem
 	NOT-FOR-US: OpenEMR
 CVE-2022-1457 (Store XSS in title parameter executing at EditUser Page & EditProd ...)
 	NOT-FOR-US: facturascripts
-CVE-2022-1456
-	RESERVED
+CVE-2022-1456 (The Poll Maker WordPress plugin before 4.0.2 does not sanitise and esc ...)
+	TODO: check
 CVE-2021-46789 (Configuration defects in the secure OS module.Successful exploitation  ...)
 	NOT-FOR-US: Huawei
 CVE-2021-46788 (Third-party pop-up window coverage vulnerability in the iConnect modul ...)
@@ -6567,8 +6613,8 @@ CVE-2022-1397 (API Privilege Escalation in GitHub repository alextselegidis/easy
 	NOT-FOR-US: alextselegidis/easyappointments
 CVE-2022-1396 (The Donorbox WordPress plugin before 7.1.7 does not sanitise and escap ...)
 	NOT-FOR-US: WordPress plugin
-CVE-2022-1395
-	RESERVED
+CVE-2022-1395 (The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 do ...)
+	TODO: check
 CVE-2022-1394
 	RESERVED
 CVE-2022-1393 (The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field an ...)
@@ -6820,8 +6866,8 @@ CVE-2022-28717 (Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino R
 	NOT-FOR-US: Rebooter
 CVE-2022-27632 (Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT ...)
 	NOT-FOR-US: Rebooter
-CVE-2022-1387
-	RESERVED
+CVE-2022-1387 (The No Future Posts WordPress plugin through 1.4 does not escape its s ...)
+	TODO: check
 CVE-2022-1386 (The Fusion Builder WordPress plugin before 3.6.2, used in the Avada th ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-29405 (In Apache Archiva, any registered user can reset password for any user ...)
@@ -7935,8 +7981,8 @@ CVE-2022-1301
 	RESERVED
 CVE-2022-1300 (Multiple Version of TRUMPF TruTops products expose a service function  ...)
 	NOT-FOR-US: TRUMPF TruTops
-CVE-2022-1299
-	RESERVED
+CVE-2022-1299 (The Slideshow WordPress plugin through 2.3.1 does not sanitize and esc ...)
+	TODO: check
 CVE-2022-1298 (The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Ta ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-1297 (Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repo ...)
@@ -7949,8 +7995,8 @@ CVE-2022-1296 (Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub re
 	NOTE: https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6
 CVE-2022-1295 (Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior ...)
 	NOT-FOR-US: fullpage.js
-CVE-2022-1294
-	RESERVED
+CVE-2022-1294 (The IMDB info box WordPress plugin through 2.0 does not sanitize and e ...)
+	TODO: check
 CVE-2022-1293
 	RESERVED
 CVE-2022-1292 (The c_rehash script does not properly sanitise shell metacharacters to ...)
@@ -8477,8 +8523,8 @@ CVE-2022-28801
 	RESERVED
 CVE-2022-28800
 	RESERVED
-CVE-2022-28799
-	RESERVED
+CVE-2022-28799 (The TikTok application before 23.8.4 for Android allows account takeov ...)
+	TODO: check
 CVE-2022-28798
 	RESERVED
 CVE-2022-28797
@@ -8791,8 +8837,8 @@ CVE-2022-1276 (Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mru
 	- mruby <not-affected> (Vulnerable code introduced later)
 	NOTE: https://huntr.dev/bounties/6ea041d1-e2aa-472c-bf3e-da5fa8726c25
 	NOTE: https://github.com/mruby/mruby/commit/c8c083cb750606b2da81582cd8e43b442bb143e6
-CVE-2022-1275
-	RESERVED
+CVE-2022-1275 (The BannerMan WordPress plugin through 0.2.4 does not sanitize or esca ...)
+	TODO: check
 CVE-2022-1274
 	RESERVED
 CVE-2022-1273 (The Import WP WordPress plugin before 2.4.6 does not validate the impo ...)
@@ -9739,8 +9785,8 @@ CVE-2022-1204
 	{DSA-5127-1}
 	- linux 5.17.3-1
 	NOTE: https://www.openwall.com/lists/oss-security/2022/04/02/2
-CVE-2022-1203
-	RESERVED
+CVE-2022-1203 (The Content Mask WordPress plugin before 1.8.4.1 does not have authori ...)
+	TODO: check
 CVE-2022-1202
 	RESERVED
 CVE-2022-1201 (NULL Pointer Dereference in mrb_vm_exec with super in GitHub repositor ...)
@@ -13059,8 +13105,8 @@ CVE-2022-1011 (A use-after-free flaw was found in the Linux kernel’s FUSE
 	NOTE: https://git.kernel.org/linus/0c4bcfdecb1ac0967619ee7ff44871d93c08c909 (5.17-rc8)
 CVE-2022-1010
 	RESERVED
-CVE-2022-1009
-	RESERVED
+CVE-2022-1009 (The Smush WordPress plugin before 3.9.9 does not sanitise and escape a ...)
+	TODO: check
 CVE-2022-1008 (The One Click Demo Import WordPress plugin before 3.1.0 does not valid ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-1007 (The Advanced Booking Calendar WordPress plugin before 1.7.1 does not s ...)
@@ -18602,8 +18648,8 @@ CVE-2022-0644 [vfs: check fd has read access in kernel_read_file_from_fd()]
 	NOTE: https://git.kernel.org/linus/032146cda85566abcd1c4884d9d23e4e30a07e9a (5.15-rc7)
 CVE-2022-0643 (The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and e ...)
 	NOT-FOR-US: WordPress plugin
-CVE-2022-0642
-	RESERVED
+CVE-2022-0642 (The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not proper ...)
+	TODO: check
 CVE-2022-0641 (The Popup Like box WordPress plugin before 3.6.1 does not sanitize and ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-0640 (The Pricing Table Builder WordPress plugin before 1.1.5 does not sanit ...)
@@ -22862,8 +22908,8 @@ CVE-2022-0378 (Cross-site Scripting (XSS) - Reflected in Packagist microweber/mi
 	NOT-FOR-US: microweber
 CVE-2022-0377 (Users of the LearnPress WordPress plugin before 4.1.5 can upload an im ...)
 	NOT-FOR-US: WordPress plugin
-CVE-2022-0376
-	RESERVED
+CVE-2022-0376 (The User Meta WordPress plugin before 2.4.3 does not sanitise and esca ...)
+	TODO: check
 CVE-2022-0375 (Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat ...)
 	NOT-FOR-US: livehelperchat
 CVE-2022-0374 (Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat ...)
@@ -33888,6 +33934,7 @@ CVE-2021-23170
 CVE-2021-23148
 	RESERVED
 CVE-2021-44759 (Improper Authentication vulnerability in TLS origin validation of Apac ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.0+ds-1
 	NOTE: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
 	NOTE: Mark first 9.x version as fixed version, as the issue only affects versions
@@ -36228,6 +36275,7 @@ CVE-2021-3983 (kimai2 is vulnerable to Improper Neutralization of Input During W
 CVE-2022-21742
 	RESERVED
 CVE-2021-44040 (Improper Input Validation vulnerability in request line parsing of Apa ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.2+ds-1
 	NOTE: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
 	NOTE: https://github.com/apache/trafficserver/commit/85c319a7f7c0537bee408ea25df6f1a5ed0a4071
@@ -41581,11 +41629,11 @@ CVE-2021-42862
 	RESERVED
 CVE-2021-42861
 	RESERVED
-CVE-2021-42860 (A stack buffer overflow exists in Mini-XML v3.2. When inputting an unf ...)
+CVE-2021-42860 (** DISPUTED ** A stack buffer overflow exists in Mini-XML v3.2. When i ...)
 	- mxml <undetermined>
 	NOTE: https://github.com/michaelrsweet/mxml/issues/286
 	TODO: check, unclear details from reporter and upstream cannot reproduce on current master
-CVE-2021-42859 (A memory leak issue was discovered in Mini-XML v3.2 that could cause a ...)
+CVE-2021-42859 (** DISPUTED ** A memory leak issue was discovered in Mini-XML v3.2 tha ...)
 	- mxml <undetermined>
 	NOTE: https://github.com/michaelrsweet/mxml/issues/286
 	TODO: check, unclear details from reporter and upstream cannot reproduce on current master
@@ -54677,6 +54725,7 @@ CVE-2021-38163 (SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.
 CVE-2021-38162 (SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22 ...)
 	NOT-FOR-US: SAP
 CVE-2021-38161 (Improper Authentication vulnerability in TLS origin verification of Ap ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.0+ds-1
 	NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
 	NOTE: Mark first 9.x version as the fixed version as workaround, the issue does
@@ -57267,18 +57316,21 @@ CVE-2021-37159 (hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel
 CVE-2021-37150
 	RESERVED
 CVE-2021-37149 (Improper Input Validation vulnerability in header parsing of Apache Tr ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.1+ds-1
 	NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
 	NOTE: https://github.com/apache/trafficserver/pull/8458/
 	NOTE: https://github.com/apache/trafficserver/commit/2addc8ca71449ceac0d5b80172460ee09c938f5e (8.1.x)
 	NOTE: https://github.com/apache/trafficserver/commit/83c89f3d217d473ecb000b68c910c0f183c3a355 (master)
 CVE-2021-37148 (Improper input validation vulnerability in header parsing of Apache Tr ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.1+ds-1
 	NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
 	NOTE: https://github.com/apache/trafficserver/pull/8457/
 	NOTE: https://github.com/apache/trafficserver/commit/6e5070118a20772a30c3fccee2cf1c44f0a21fc0 (master)
 	NOTE: https://github.com/apache/trafficserver/commit/e2c9ac217f24dc3e91ff2c9f52b52093e8fb32d5 (8.1.x)
 CVE-2021-37147 (Improper input validation vulnerability in header parsing of Apache Tr ...)
+	{DSA-5153-1}
 	- trafficserver 9.1.1+ds-1
 	NOTE: https://www.openwall.com/lists/oss-security/2021/11/02/11
 	NOTE: https://github.com/apache/trafficserver/commit/64f25678bfbbd1433cce703e3c43bcc49a53de56 (master)
@@ -118318,6 +118370,7 @@ CVE-2020-25614 (xmlquery before 1.3.1 lacks a check for whether a LoadURL respon
 	- golang-github-antchfx-xmlquery 1.3.3-1
 	NOTE: https://github.com/antchfx/xmlquery/issues/39
 CVE-2014-10402 (An issue was discovered in the DBI module through 1.643 for Perl. DBD: ...)
+	{DLA-3035-1}
 	- libdbi-perl 1.643-3 (bug #972180)
 	[buster] - libdbi-perl 1.642-1+deb10u2
 	NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=99508#txn-1911590
@@ -184875,6 +184928,7 @@ CVE-2019-18279 (In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included
 CVE-2019-18278 (When executing VideoLAN VLC media player 3.0.8 with libqt on Windows,  ...)
 	NOT-FOR-US: VLC on Windows
 CVE-2019-18277 (A flaw was found in HAProxy before 2.0.6. In legacy mode, messages fea ...)
+	{DLA-3034-1}
 	- haproxy 2.0.6-1
 	[buster] - haproxy 1.8.19-1+deb10u3
 	[jessie] - haproxy <no-dsa> (Minor issue)
@@ -233242,10 +233296,12 @@ CVE-2018-20105 (A Inclusion of Sensitive Information in Log Files vulnerability
 CVE-2018-20104
 	RESERVED
 CVE-2018-20103 (An issue was discovered in dns.c in HAProxy through 1.8.14. In the cas ...)
+	{DLA-3034-1}
 	- haproxy 1.8.15-1 (bug #916307)
 	[jessie] - haproxy <not-affected> (Vulnerable code not present)
 	NOTE: http://git.haproxy.org/?p=haproxy.git;a=commit;h=58df5aea0a0c926b2238f65908f5e9f83d1cca25
 CVE-2018-20102 (An out-of-bounds read in dns_validate_dns_response in dns.c was discov ...)
+	{DLA-3034-1}
 	- haproxy 1.8.15-1 (bug #916308)
 	[jessie] - haproxy <not-affected> (Vulnerable code not present)
 	NOTE: http://git.haproxy.org/?p=haproxy.git;a=commit;h=efbbdf72992cd20458259962346044cafd9331c0



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6bbdf8b0331010bf2178c7a9951b855998d912a3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6bbdf8b0331010bf2178c7a9951b855998d912a3
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220530/fa904303/attachment.htm>

More information about the debian-security-tracker-commits mailing list