[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Sep 24 12:31:29 BST 2022 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
28112fcd by Salvatore Bonaccorso at 2022-09-24T13:31:07+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -852,7 +852,7 @@ CVE-2022-40985
 CVE-2022-40980 (A potential unathenticated file deletion vulnerabilty on Trend Micro M ...)
 	NOT-FOR-US: Trend Micro
 CVE-2022-40979 (In JetBrains TeamCity before 2022.04.4 environmental variables of "pas ...)
-	TODO: check
+	NOT-FOR-US: JetBrains TeamCity
 CVE-2022-40978 (The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerabl ...)
 	NOT-FOR-US: installer of JetBrains IntelliJ IDEA
 CVE-2022-40977
@@ -1760,11 +1760,11 @@ CVE-2022-3193
 	RESERVED
 	NOT-FOR-US: ovirt-engine
 CVE-2022-40630 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...)
-	TODO: check
+	NOT-FOR-US: Tacitine Firewall
 CVE-2022-40629 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...)
-	TODO: check
+	NOT-FOR-US: Tacitine Firewall
 CVE-2022-40628 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...)
-	TODO: check
+	NOT-FOR-US: Tacitine Firewall
 CVE-2022-40627
 	RESERVED
 CVE-2022-40626 (An unauthenticated user can create a link with reflected Javascript co ...)
@@ -6284,7 +6284,7 @@ CVE-2022-38744
 CVE-2022-38743
 	RESERVED
 CVE-2022-38742 (Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is ...)
-	TODO: check
+	NOT-FOR-US: Rockwell Automation
 CVE-2022-38741
 	RESERVED
 CVE-2022-38740
@@ -7167,9 +7167,9 @@ CVE-2022-38441
 CVE-2022-38440
 	RESERVED
 CVE-2022-38439 (Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected b ...)
-	TODO: check
+	NOT-FOR-US: Adobe
 CVE-2022-38438 (Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected b ...)
-	TODO: check
+	NOT-FOR-US: Adobe
 CVE-2022-38437
 	RESERVED
 CVE-2022-38436
@@ -8351,7 +8351,7 @@ CVE-2022-38067 (Unauthenticated Event Deletion vulnerability in Totalsoft Event
 CVE-2022-38062
 	RESERVED
 CVE-2022-38061 (Authenticated (author+) CSV Injection vulnerability in Export Post Inf ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-38059 (Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's A ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-38058 (Authenticated (subscriber+) Plugin Setting change vulnerability in WP  ...)
@@ -8375,23 +8375,23 @@ CVE-2022-37402
 CVE-2022-37344 (Missing Access Control vulnerability in PHP Crafts Accommodation Syste ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-37339 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-37338 (Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-37335 (Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerabilit ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-37330 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-37328 (Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-36798 (Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Me ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-36796 (Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cros ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-36793 (Unauthenticated Plugin Settings Change & Data Deletion vulnerabili ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-36791 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2022-36428
 	RESERVED
 CVE-2022-36427 (Missing Access Control vulnerability in About Rentals. Inc. About Rent ...)
@@ -12686,7 +12686,7 @@ CVE-2022-36359 (An issue was discovered in the HTTP FileResponse class in Django
 CVE-2022-36342
 	RESERVED
 CVE-2022-36338 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...)
-	TODO: check
+	NOT-FOR-US: Insyde
 CVE-2022-36337
 	RESERVED
 CVE-2022-36336 (A link following vulnerability in the scanning function of Trend Micro ...)
@@ -13900,7 +13900,7 @@ CVE-2022-35895 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 thro
 CVE-2022-35894 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...)
 	NOT-FOR-US: Insyde
 CVE-2022-35893 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...)
-	TODO: check
+	NOT-FOR-US: Insyde
 CVE-2022-35892
 	RESERVED
 CVE-2022-35891
@@ -15603,17 +15603,17 @@ CVE-2022-35252 (When curl is used to retrieve and parse cookies from a HTTP(S) s
 	NOTE: https://www.openwall.com/lists/oss-security/2022/08/31/2
 	NOTE: https://daniel.haxx.se/blog/2022/09/05/a-bug-that-was-23-years-old-or-not/
 CVE-2022-35251 (A cross-site scripting vulnerability exists in Rocket.chat <v5 due  ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-35250 (A privilege escalation vulnerability exists in Rocket.chat <v5 whic ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-35249 (A information disclosure vulnerability exists in Rocket.Chat <v5 wh ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-35248 (A improper authentication vulnerability exists in Rocket.Chat <v5,  ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-35247 (A information disclosure vulnerability exists in Rocket.chat <v5, & ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-35246 (A NoSQL-Injection information disclosure vulnerability vulnerability e ...)
-	TODO: check
+	NOT-FOR-US: Rocket.Chat
 CVE-2022-34866 (Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box ve ...)
 	NOT-FOR-US: Passage Drive
 CVE-2022-32765
@@ -21549,7 +21549,7 @@ CVE-2022-2072 (The Name Directory WordPress plugin before 1.25.3 does not saniti
 CVE-2022-2071 (The Name Directory WordPress plugin before 1.25.4 does not have CSRF c ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-2070 (In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to over ...)
-	TODO: check
+	NOT-FOR-US: Grandstream
 CVE-2022-2069
 	RESERVED
 CVE-2022-2068 (In addition to the c_rehash shell command injection identified in CVE- ...)
@@ -21924,31 +21924,31 @@ CVE-2022-32855
 CVE-2022-32854 (This issue was addressed with improved checks. This issue is fixed in  ...)
 	NOT-FOR-US: Apple
 CVE-2022-32853 (An out-of-bounds read issue was addressed with improved input validati ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32852 (An out-of-bounds read issue was addressed with improved input validati ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32851 (An out-of-bounds read issue was addressed with improved input validati ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32850
 	RESERVED
 CVE-2022-32849 (An information disclosure issue was addressed by removing the vulnerab ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32848 (A logic issue was addressed with improved checks. This issue is fixed  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32847 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32846
 	RESERVED
 CVE-2022-32845 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32844
 	RESERVED
 CVE-2022-32843 (An out-of-bounds write issue was addressed with improved bounds checki ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32842 (An out-of-bounds read issue was addressed with improved input validati ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32841 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32840 (This issue was addressed with improved checks. This issue is fixed in  ...)
 	NOT-FOR-US: Apple
 CVE-2022-32839 (The issue was addressed with improved bounds checks. This issue is fix ...)
@@ -21966,46 +21966,46 @@ CVE-2022-32834 (An access issue was addressed with improvements to the sandbox.
 CVE-2022-32833
 	RESERVED
 CVE-2022-32832 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32831 (An out-of-bounds read was addressed with improved bounds checking. Thi ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32830
 	RESERVED
 CVE-2022-32829 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32828 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32827
 	RESERVED
 CVE-2022-32826 (An authorization issue was addressed with improved state management. T ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32825 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32824
 	RESERVED
 CVE-2022-32823 (A memory initialization issue was addressed with improved memory handl ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32822
 	RESERVED
 CVE-2022-32821 (A memory corruption issue was addressed with improved validation. This ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32820 (An out-of-bounds write issue was addressed with improved input validat ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32819 (A logic issue was addressed with improved state management. This issue ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32818 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32817 (An out-of-bounds read issue was addressed with improved bounds checkin ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32816 (The issue was addressed with improved UI handling. This issue is fixed ...)
 	{DSA-5211-1 DSA-5210-1 DLA-3073-1}
 	- webkit2gtk 2.36.6-1
 	- wpewebkit 2.36.6-1
 	NOTE: https://www.openwall.com/lists/oss-security/2022/07/28/2
 CVE-2022-32815 (The issue was addressed with improved memory handling. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32814 (A type confusion issue was addressed with improved state handling. Thi ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32813 (The issue was addressed with improved memory handling. This issue is f ...)
 	NOT-FOR-US: Apple
 CVE-2022-32812 (The issue was addressed with improved memory handling. This issue is f ...)
@@ -22019,11 +22019,11 @@ CVE-2022-32809
 CVE-2022-32808
 	RESERVED
 CVE-2022-32807 (This issue was addressed with improved file handling. This issue is fi ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32806
 	RESERVED
 CVE-2022-32805 (The issue was addressed with improved handling of caches. This issue i ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32804
 	RESERVED
 CVE-2022-32803
@@ -22031,17 +22031,17 @@ CVE-2022-32803
 CVE-2022-32802 (A logic issue was addressed with improved checks. This issue is fixed  ...)
 	NOT-FOR-US: Apple
 CVE-2022-32801 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32800 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32799 (An out-of-bounds read issue was addressed with improved bounds checkin ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32798 (An out-of-bounds write issue was addressed with improved input validat ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32797 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32796 (A memory corruption issue was addressed with improved state management ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32795 (This issue was addressed with improved checks. This issue is fixed in  ...)
 	NOT-FOR-US: Apple
 CVE-2022-32794
@@ -22057,25 +22057,25 @@ CVE-2022-32792 (An out-of-bounds write issue was addressed with improved input v
 CVE-2022-32791
 	RESERVED
 CVE-2022-32790 (This issue was addressed with improved checks. This issue is fixed in  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32789 (A logic issue was addressed with improved checks. This issue is fixed  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32788 (A buffer overflow was addressed with improved bounds checking. This is ...)
 	NOT-FOR-US: Apple
 CVE-2022-32787 (An out-of-bounds write issue was addressed with improved bounds checki ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32786 (An issue in the handling of environment variables was addressed with i ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32785 (A null pointer dereference was addressed with improved validation. Thi ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32784
 	RESERVED
 CVE-2022-32783 (A logic issue was addressed with improved checks. This issue is fixed  ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32782 (This issue was addressed by enabling hardened runtime. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32781 (This issue was addressed by enabling hardened runtime. This issue is f ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-32780
 	RESERVED
 CVE-2022-32779
@@ -22626,7 +22626,7 @@ CVE-2022-2027 (Improper Neutralization of Formula Elements in a CSV File in GitH
 CVE-2022-2026 (Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/ti ...)
 	NOT-FOR-US: kromitgmbh/titra
 CVE-2022-2025 (an attacker with knowledge of user/pass of Grandstream GSD3710 in its  ...)
-	TODO: check
+	NOT-FOR-US: Grandstream
 CVE-2017-20051 (A vulnerability was found in InnoSetup Installer. It has been declared ...)
 	NOT-FOR-US: InnoSetup
 CVE-2022-32548 (An issue was discovered on certain DrayTek Vigor routers before July 2 ...)
@@ -23595,13 +23595,13 @@ CVE-2022-1977 (The Import Export All WordPress Images, Users & Post Types Wo
 CVE-2022-32230 (Microsoft Windows SMBv3 suffers from a null pointer dereference in ver ...)
 	NOT-FOR-US: Microsoft
 CVE-2022-32229 (A information disclosure vulnerability exists in Rockert.Chat <v5 d ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32228 (An information disclosure vulnerability exists in Rocket.Chat <v5,  ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32227 (A cleartext transmission of sensitive information exists in Rocket.Cha ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32226 (An improper access control vulnerability exists in Rocket.Chat <v5, ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32225 (A reflected DOM-Based XSS vulnerability has been discovered in the Hel ...)
 	NOT-FOR-US: Veeam
 CVE-2022-32224
@@ -23622,13 +23622,13 @@ CVE-2022-32222 (A cryptographic vulnerability exists on Node.js on linux in vers
 CVE-2022-32221
 	RESERVED
 CVE-2022-32220 (An information disclosure vulnerability exists in Rocket.Chat <v5 d ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32219 (An information disclosure vulnerability exists in Rocket.Chat <v4.7 ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32218 (An information disclosure vulnerability exists in Rocket.Chat <v5,  ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32217 (A cleartext storage of sensitive information exists in Rocket.Chat &lt ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32216
 	RESERVED
 CVE-2022-32215 (The llhttp parser in the http module in Node v17.6.0 does not correctl ...)
@@ -23660,7 +23660,7 @@ CVE-2022-32212 (A OS Command Injection vulnerability exists in Node.js versions
 	NOTE: https://github.com/nodejs/node/commit/48c5aa5cab718d04473fa2761d532657c84b8131 (v14.x)
 	NOTE: https://github.com/nodejs/node/commit/1aa5036c31ac2a9b2a2528af454675ad412f1464 (main)
 CVE-2022-32211 (A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v ...)
-	TODO: check
+	NOT-FOR-US: Rockert.Chat
 CVE-2022-32210 (`Undici.ProxyAgent` never verifies the remote server's certificate, an ...)
 	- node-undici 5.6.1+dfsg1+~cs18.9.16-1
 	NOTE: https://github.com/advisories/GHSA-pgw7-wx7w-2w33
@@ -33625,7 +33625,7 @@ CVE-2022-28888 (Spryker Commerce OS 1.4.2 allows Remote Command Execution. ...)
 CVE-2022-28887
 	RESERVED
 CVE-2022-28886 (A Denial-of-Service vulnerability was discovered in the F-Secure and W ...)
-	TODO: check
+	NOT-FOR-US: F-Secure
 CVE-2022-28885 (A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd  ...)
 	NOT-FOR-US: WithSecure
 CVE-2022-28884 (A Denial-of-Service vulnerability was discovered in the F-Secure and W ...)
@@ -36026,7 +36026,7 @@ CVE-2022-1123 (The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) W
 CVE-2021-46743 (In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g.,  ...)
 	NOT-FOR-US: Firebase PHP-JWT
 CVE-2020-36521 (An out-of-bounds read was addressed with improved input validation. Th ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2022-28128 (Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and ear ...)
 	NOT-FOR-US: AttacheCase
 CVE-2022-27496 (Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and ...)
@@ -37665,7 +37665,7 @@ CVE-2022-1039 (The weak password on the web user interface can be exploited via
 CVE-2022-1038
 	RESERVED
 CVE-2022-27492 (An integer underflow in WhatsApp could have caused remote code executi ...)
-	TODO: check
+	NOT-FOR-US: WhatsApp
 CVE-2022-27491 (A improper verification of source of a communication channel in Fortin ...)
 	NOT-FOR-US: FortiGuard
 CVE-2022-27490



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/28112fcd8e6c79054bb917d80e5a4e61596927f8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/28112fcd8e6c79054bb917d80e5a4e61596927f8
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220924/2a83153b/attachment.htm>

More information about the debian-security-tracker-commits mailing list