[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Dec 4 21:21:48 GMT 2024 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e217b257 by Salvatore Bonaccorso at 2024-12-04T22:21:30+01:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -25,7 +25,7 @@ CVE-2024-54132 (The GitHub CLI is GitHub\u2019s official command line tool. A se
 	NOTE: https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj
 	NOTE: Merge commit: https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932 (v2.63.1)
 CVE-2024-54002 (Dependency-Track is a Component Analysis platform that allows organiza ...)
-	TODO: check
+	NOT-FOR-US: Dependency-Track
 CVE-2024-53614 (A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attac ...)
 	NOT-FOR-US: Thinkware Cloud APK
 CVE-2024-52676 (Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to  ...)
@@ -51,51 +51,51 @@ CVE-2024-51465 (IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6,
 CVE-2024-48453 (An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to exe ...)
 	NOT-FOR-US: INOVANCE AM401_CPU1608TPTN
 CVE-2024-40745 (Reflected Cross site scripting vulnerability in Convert Forms componen ...)
-	TODO: check
+	NOT-FOR-US: Convert Forms component for Joomla
 CVE-2024-40744 (Unrestricted file upload via security bypass in Convert Forms componen ...)
-	TODO: check
+	NOT-FOR-US: Convert Forms component for Joomla
 CVE-2024-39163 (binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Re ...)
-	TODO: check
+	NOT-FOR-US: binux pyspider
 CVE-2024-37575 (The Mister org.mistergroup.shouldianswer application 1.4.264 for Andro ...)
-	TODO: check
+	NOT-FOR-US: Mister org.mistergroup.shouldianswer application
 CVE-2024-37574 (The GriceMobile com.grice.call application 4.5.2 for Android enables a ...)
-	TODO: check
+	NOT-FOR-US: GriceMobile com.grice.call application
 CVE-2024-20397 (A vulnerability in the bootloader of Cisco NX-OS Software could allow  ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2024-12196 (Incorrect authorization in the permission component in Devolutions Ser ...)
-	TODO: check
+	NOT-FOR-US: Devolutions Server
 CVE-2024-12151 (Incorrect permission assignment in the user migration feature in Devol ...)
-	TODO: check
+	NOT-FOR-US: Devolutions Server
 CVE-2024-12149 (Incorrect permission assignment in temporary access requests component ...)
-	TODO: check
+	NOT-FOR-US: Devolutions Remote Desktop Manager
 CVE-2024-12148 (Incorrect authorization in permission validation component in Devoluti ...)
-	TODO: check
+	NOT-FOR-US: Devolutions Server
 CVE-2024-12147 (A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has bee ...)
-	TODO: check
+	NOT-FOR-US: Netgear
 CVE-2024-12138 (A vulnerability classified as critical was found in horilla up to 1.2. ...)
 	TODO: check
 CVE-2024-12107 (Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint I ...)
-	TODO: check
+	NOT-FOR-US: uD3TN
 CVE-2024-12056 (The Client secret is not checked when using the OAuth Password grant t ...)
 	TODO: check
 CVE-2024-11952 (The Classic Addons \u2013 WPBakery Page Builder plugin for WordPress i ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-11935 (The Email Address Obfuscation plugin for WordPress is vulnerable to St ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-11880 (The B Testimonial \u2013 testimonial plugin for WP plugin for WordPres ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-11854 (The Listdom \u2013 Business Directory and Classified Ads Listings Word ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-11814 (The Additional Custom Order Status for WooCommerce plugin for WordPres ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-11643 (The Accessibility by AllAccessible plugin for WordPress is vulnerable  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-10787 (The LA-Studio Element Kit for Elementor plugin for WordPress is vulner ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-10576 (Infinix devices contain a pre-loaded "com.transsion.agingfunction" app ...)
-	TODO: check
+	NOT-FOR-US: Infinix devices
 CVE-2024-10567 (The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unau ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-53908 [Potential SQL injection in HasKey(lhs, rhs) on Oracle]
 	- python-django 3:4.2.17-1
 	NOTE: https://www.djangoproject.com/weblog/2024/dec/04/security-releases/
@@ -334,7 +334,7 @@ CVE-2024-37302 (Synapse is an open-source Matrix homeserver. Synapse versions be
 	- matrix-synapse 1.116.0-1
 	NOTE: https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x
 CVE-2024-29404 (An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.202402 ...)
-	TODO: check
+	NOT-FOR-US: Razer
 CVE-2024-25036 (IBM Cognos Controller 11.0.0 and 11.0.1       could allow an authentic ...)
 	NOT-FOR-US: IBM
 CVE-2024-25035 (IBM Cognos Controller 11.0.0 and 11.0.1     exposes server details tha ...)
@@ -743,7 +743,7 @@ CVE-2024-12015 (The 'Project Manager' WordPress Plugin is affected by an authent
 CVE-2024-10905 (IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 ...)
 	TODO: check
 CVE-2024-10490 (An \u201cAuthentication Bypass Using an Alternate Path or Channel\u201 ...)
-	TODO: check
+	NOT-FOR-US: B&R Automation
 CVE-2024-53124 (In the Linux kernel, the following vulnerability has been resolved:  n ...)
 	- linux 6.11.10-1
 	NOTE: https://git.kernel.org/linus/073d89808c065ac4c672c0a613a71b27a80691cb (6.12)
@@ -476400,13 +476400,13 @@ CVE-2018-9397
 CVE-2018-9396
 	RESERVED
 CVE-2018-9395 (In mtk_cfg80211_vendor_packet_keep_alive_start and mtk_cfg80211_vendor ...)
-	TODO: check
+	NOT-FOR-US: Android
 CVE-2018-9394 (In mtk_p2p_wext_set_key of drivers/misc/mediatek/connectivity/wlan/gen ...)
-	TODO: check
+	NOT-FOR-US: Android
 CVE-2018-9393 (In procfile_write of drivers/misc/mediatek/connectivity/wlan/gen2/os/l ...)
-	TODO: check
+	NOT-FOR-US: Android
 CVE-2018-9392 (In get_binary of vendor/mediatek/proprietary/hardware/connectivity/gps ...)
-	TODO: check
+	NOT-FOR-US: Android
 CVE-2018-9391
 	RESERVED
 CVE-2018-9390



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e217b257bf9880ed05edc27115379d7201216c1e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e217b257bf9880ed05edc27115379d7201216c1e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241204/34503dfd/attachment.htm>

More information about the debian-security-tracker-commits mailing list