[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Apr 18 10:35:17 BST 2024 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a876ec28 by Moritz Muehlenhoff at 2024-04-18T11:33:26+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,55 +3,55 @@ CVE-2024-3177
 	NOTE: Server components no longer built since 1.20.5+really1.20.2-1, marking that as fixed version
 	NOTE: The source package itself it still vulnerable, but custom rebuilds are not really a usecase here
 CVE-2024-3932 (A vulnerability classified as problematic has been found in Totara LMS ...)
-	TODO: check
+	NOT-FOR-US: Totara LMS
 CVE-2024-3931 (A vulnerability was found in Totara LMS 18.0.1 Build 20231128.01. It h ...)
-	TODO: check
+	NOT-FOR-US: Totara LMS
 CVE-2024-3928 (A vulnerability was found in Dromara open-capacity-platform 2.0.1. It  ...)
-	TODO: check
+	NOT-FOR-US: Dromara open-capacity-platform
 CVE-2024-32746 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32745 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32744 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32743 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32472 (excalidraw is an open source virtual hand-drawn style whiteboard. A st ...)
-	TODO: check
+	NOT-FOR-US: excalidraw
 CVE-2024-32345 (A cross-site scripting (XSS) vulnerability in the Settings menu of CMS ...)
-	TODO: check
+	NOT-FOR-US: CMSimple
 CVE-2024-32344 (A cross-site scripting (XSS) vulnerability in the Settings menu of CMS ...)
-	TODO: check
+	NOT-FOR-US: CMSimple
 CVE-2024-32343 (A cross-site scripting (XSS) vulnerability in the Create Page of Boid  ...)
-	TODO: check
+	NOT-FOR-US: Boid CMS
 CVE-2024-32342 (A cross-site scripting (XSS) vulnerability in the Create Page of Boid  ...)
-	TODO: check
+	NOT-FOR-US: Boid CMS
 CVE-2024-32341 (Multiple cross-site scripting (XSS) vulnerabilities in the Home page o ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32340 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32339 (Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32338 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-32337 (A cross-site scripting (XSS) vulnerability in the Settings section of  ...)
-	TODO: check
+	NOT-FOR-US: WonderCMS
 CVE-2024-31869 (Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows  ...)
-	TODO: check
+	- airflow <itp> (bug #819700)
 CVE-2024-2729 (The Otter Blocks  WordPress plugin before 2.6.6 does not properly esca ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-29956 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the ...)
-	TODO: check
+	NOT-FOR-US: Brocade
 CVE-2024-29955 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allo ...)
-	TODO: check
+	NOT-FOR-US: Brocade
 CVE-2024-29952 (A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allo ...)
-	TODO: check
+	NOT-FOR-US: Brocade
 CVE-2024-1429 (The Element Pack Elementor Addons (Header Footer, Free Template Librar ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-1426 (The Element Pack Elementor Addons (Header Footer, Free Template Librar ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2023-4509 (It is possible for an API key to be logged in clear text in the audit  ...)
-	TODO: check
+	NOT-FOR-US: Octopus Deploy
 CVE-2023-4235 (A flaw was found in ofono, an Open Source Telephony on Linux. A stack  ...)
 	TODO: check
 CVE-2023-4234 (A flaw was found in ofono, an Open Source Telephony on Linux. A stack  ...)
@@ -79,7 +79,7 @@ CVE-2024-3905 (A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has be
 CVE-2024-3900 (Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long  ...)
 	TODO: check
 CVE-2024-3825 (Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw ...)
-	TODO: check
+	NOT-FOR-US: Jenkins plugin
 CVE-2024-3817 (HashiCorp\u2019s go-getter library is vulnerable to argument injection ...)
 	- golang-github-hashicorp-go-getter <unfixed>
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040
@@ -262,15 +262,15 @@ CVE-2024-30951 (FUDforum v3.1.3 was discovered to contain a reflected cross-site
 CVE-2024-30950 (A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 a ...)
 	NOT-FOR-US: FUDforum
 CVE-2024-30253 (@solana/web3.js is the Solana JavaScript SDK. Using particular inputs  ...)
-	TODO: check
+	NOT-FOR-US: @solana/web3.js
 CVE-2024-2419 (A flaw was found in Keycloak's redirect_uri validation logic. This iss ...)
 	NOT-FOR-US: Keycloak
 CVE-2024-29951 (Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in intern ...)
-	TODO: check
+	NOT-FOR-US: Brocade
 CVE-2024-29950 (The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2 ...)
-	TODO: check
+	NOT-FOR-US: Brocade
 CVE-2024-29035 (Umbraco is an ASP.NET CMS. Failing webhooks logs are available when so ...)
-	TODO: check
+	NOT-FOR-US: Umbraco
 CVE-2024-28073 (SolarWinds Serv-U was found to be susceptible to a Directory Traversal ...)
 	NOT-FOR-US: SolarWinds
 CVE-2024-24856 (The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee ...)
@@ -280,57 +280,57 @@ CVE-2024-21990 (ONTAP Select Deploy administration utility versions 9.12.1.x,  9
 CVE-2024-21989 (ONTAP Select Deploy administration utility versions 9.12.1.x,  9.13.1. ...)
 	NOT-FOR-US: ONTAP / NetAPP
 CVE-2024-1350 (Missing Authorization vulnerability in Prasidhda Malla Honeypot for WP ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-1249 (A flaw was found in Keycloak's OIDC component in the "checkLoginIframe ...)
 	NOT-FOR-US: Keycloak
 CVE-2024-1132 (A flaw was found in Keycloak, where it does not properly validate URLs ...)
 	NOT-FOR-US: Keycloak
 CVE-2024-0257 (RoboDK v5.5.4   is vulnerable to heap-based buffer overflow while proc ...)
-	TODO: check
+	NOT-FOR-US: RoboDK
 CVE-2023-6805 (The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2023-5407 (Controller denial of service due to improper handling of a specially c ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5406 (Server communication with a controller can lead to remote code executi ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5405 (Server information leak for the CDA Server process memory can occur wh ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5404 (Server receiving a malformed message can cause a pointer to be overwri ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5403 (Server hostname translation to IP address manipulation which could lea ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5401 (Server receiving a malformed message based on a using the specified ke ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5400 (Server receiving a malformed message based on a using the specified ke ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5398 (Server receiving a malformed message based on a list of IPs resulting  ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5397 (Server receiving a malformed message to create a new connection could  ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5396 (Server receiving a malformed message creates connection for a hostname ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-5395 (Server receiving a malformed message that uses the hostname in an inte ...)
-	TODO: check
+	NOT-FOR-US: Honeywell
 CVE-2023-51500 (Missing Authorization vulnerability in Undsgn Uncode Core.This issue a ...)
-	TODO: check
+	NOT-FOR-US: Undsgn Uncode Core
 CVE-2023-51418 (Missing Authorization vulnerability in Joris van Montfort JVM rich tex ...)
-	TODO: check
+	NOT-FOR-US: Joris van Montfort JVM rich text icons
 CVE-2023-46060 (A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remo ...)
-	TODO: check
+	NOT-FOR-US: Tenda
 CVE-2023-45744 (A data integrity vulnerability exists in the web interface /cgi-bin/up ...)
-	TODO: check
+	NOT-FOR-US: Peplink Smart Reader
 CVE-2023-45209 (An information disclosure vulnerability exists in the web interface /c ...)
-	TODO: check
+	NOT-FOR-US: Peplink Smart Reader
 CVE-2023-44227 (Missing Authorization vulnerability in Mitchell Bennis Simple File Lis ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2023-43491 (An information disclosure vulnerability exists in the web interface /c ...)
-	TODO: check
+	NOT-FOR-US: Peplink Smart Reader
 CVE-2023-40146 (A privilege escalation vulnerability exists in the /bin/login function ...)
-	TODO: check
+	NOT-FOR-US: Peplink Smart Reader
 CVE-2023-39367 (An OS command injection vulnerability exists in the web interface mac2 ...)
-	TODO: check
+	NOT-FOR-US: Peplink Smart Reader
 CVE-2023-36505 (Improper Input Validation vulnerability in Saturday Drive Ninja Forms  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-2961 (The iconv() function in the GNU C Library versions 2.39 and older may  ...)
 	- glibc <unfixed> (bug #1069191)
 	NOTE: https://www.openwall.com/lists/oss-security/2024/04/17/9



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a876ec281abc3d9d201e69e7e15cd35f4ff22b44

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a876ec281abc3d9d201e69e7e15cd35f4ff22b44
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240418/af5c5334/attachment.htm>

More information about the debian-security-tracker-commits mailing list