[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Feb 7 08:11:58 GMT 2024 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
935efbf2 by security tracker role at 2024-02-07T08:11:45+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,13 +1,203 @@
+CVE-2024-25140 (A default installation of RustDesk 1.2.3 on Windows places a WDKTestCe ...)
+	TODO: check
+CVE-2024-24943 (In JetBrains Toolbox App before 2.2 a DoS attack was possible via a ma ...)
+	TODO: check
+CVE-2024-24942 (In JetBrains TeamCity before 2023.11.3 path traversal allowed reading  ...)
+	TODO: check
+CVE-2024-24941 (In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Spac ...)
+	TODO: check
+CVE-2024-24940 (In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible ...)
+	TODO: check
+CVE-2024-24939 (In JetBrains Rider before 2023.3.3 logging of environment variables co ...)
+	TODO: check
+CVE-2024-24938 (In JetBrains TeamCity before 2023.11.2 limited directory traversal was ...)
+	TODO: check
+CVE-2024-24937 (In JetBrains TeamCity before 2023.11.2 stored XSS via agent distributi ...)
+	TODO: check
+CVE-2024-24936 (In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifa ...)
+	TODO: check
+CVE-2024-24810 (WiX toolset lets developers create installers for Windows Installer, t ...)
+	TODO: check
+CVE-2024-24594 (A cross-site scripting (XSS) vulnerability in all versions of the web  ...)
+	TODO: check
+CVE-2024-24593 (A cross-site request forgery (CSRF) vulnerability in all versions of t ...)
+	TODO: check
+CVE-2024-24592 (Lack of authentication in all versions of the fileserver component of  ...)
+	TODO: check
+CVE-2024-24591 (A path traversal vulnerability in version 1.4.0 or newer of Allegro AI ...)
+	TODO: check
+CVE-2024-24590 (Deserialization of untrusted data can occur in version 0.17.0 or newer ...)
+	TODO: check
+CVE-2024-24291 (An issue in the component /member/index/login of yzmcms v7.0 allows at ...)
+	TODO: check
+CVE-2024-24255 (A Race Condition discovered in geofence.cpp and mission_feasibility_ch ...)
+	TODO: check
+CVE-2024-24254 (PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mec ...)
+	TODO: check
+CVE-2024-24019 (A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prio ...)
+	TODO: check
+CVE-2024-24015 (A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prio ...)
+	TODO: check
+CVE-2024-24013 (A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prio ...)
+	TODO: check
+CVE-2024-24004 (jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller ...)
+	TODO: check
+CVE-2024-24002 (jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller ...)
+	TODO: check
+CVE-2024-24001 (jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.contro ...)
+	TODO: check
+CVE-2024-24000 (jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/sy ...)
+	TODO: check
+CVE-2024-23917 (In JetBrains TeamCity before 2023.11.3 authentication bypass leading t ...)
+	TODO: check
+CVE-2024-23673 (Malicious code execution via path traversal in Apache Software Foundat ...)
+	TODO: check
+CVE-2024-23447 (An issue was discovered in the Windows Network Drive Connector when us ...)
+	TODO: check
+CVE-2024-23446 (An issue was discovered by Elastic, whereby the Detection Engine Searc ...)
+	TODO: check
+CVE-2024-23344 (Tuleap is an Open Source Suite to improve management of software devel ...)
+	TODO: check
+CVE-2024-22520 (An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers t ...)
+	TODO: check
+CVE-2024-22519 (An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to imper ...)
+	TODO: check
+CVE-2024-22515 (Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5. ...)
+	TODO: check
+CVE-2024-22514 (An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attack ...)
+	TODO: check
+CVE-2024-22388 (Certain configuration available in the communication channel for encod ...)
+	TODO: check
+CVE-2024-22331 (IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, ...)
+	TODO: check
+CVE-2024-22241 (Aria Operations for Networks contains a cross site scripting vulnerabi ...)
+	TODO: check
+CVE-2024-22240 (Aria Operations for Networks contains a local file read vulnerability. ...)
+	TODO: check
+CVE-2024-22239 (Aria Operations for Networks contains a local privilege escalation vul ...)
+	TODO: check
+CVE-2024-22238 (Aria Operations for Networks contains a cross site scripting vulnerabi ...)
+	TODO: check
+CVE-2024-22237 (Aria Operations for Networks contains a local privilege escalation vul ...)
+	TODO: check
+CVE-2024-22022 (Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user ...)
+	TODO: check
+CVE-2024-22021 (VulnerabilityCVE-2024-22021 allowsaVeeam Recovery Orchestrator user wi ...)
+	TODO: check
+CVE-2024-1269 (A vulnerability has been found in SourceCodester Product Management Sy ...)
+	TODO: check
+CVE-2024-1268 (A vulnerability, which was classified as critical, was found in CodeAs ...)
+	TODO: check
+CVE-2024-1267 (A vulnerability, which was classified as problematic, has been found i ...)
+	TODO: check
+CVE-2024-1266 (A vulnerability classified as problematic was found in CodeAstro Unive ...)
+	TODO: check
+CVE-2024-1265 (A vulnerability classified as problematic has been found in CodeAstro  ...)
+	TODO: check
+CVE-2024-1264 (A vulnerability has been found in Juanpao JPShop up to 1.5.02 and clas ...)
+	TODO: check
+CVE-2024-1263 (A vulnerability, which was classified as critical, was found in Juanpa ...)
+	TODO: check
+CVE-2024-1262 (A vulnerability, which was classified as critical, has been found in J ...)
+	TODO: check
+CVE-2024-1261 (A vulnerability classified as critical was found in Juanpao JPShop up  ...)
+	TODO: check
+CVE-2024-1260 (A vulnerability classified as critical has been found in Juanpao JPSho ...)
+	TODO: check
+CVE-2024-1259 (A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been  ...)
+	TODO: check
+CVE-2024-1258 (A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been  ...)
+	TODO: check
+CVE-2024-1257 (A vulnerability was found in Jspxcms 10.2.0. It has been classified as ...)
+	TODO: check
+CVE-2024-1256 (A vulnerability was found in Jspxcms 10.2.0 and classified as problema ...)
+	TODO: check
+CVE-2024-1255 (A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0 ...)
+	TODO: check
+CVE-2024-1254 (A vulnerability, which was classified as critical, was found in Beijin ...)
+	TODO: check
+CVE-2024-1253 (A vulnerability, which was classified as critical, has been found in B ...)
+	TODO: check
+CVE-2024-1252 (A vulnerability classified as critical was found in Tongda OA 2017 up  ...)
+	TODO: check
+CVE-2024-1251 (A vulnerability classified as critical has been found in Tongda OA 201 ...)
+	TODO: check
+CVE-2024-1079 (The Quiz Maker plugin for WordPress is vulnerable to unauthorized acce ...)
+	TODO: check
+CVE-2024-1078 (The Quiz Maker plugin for WordPress is vulnerable to unauthorized modi ...)
+	TODO: check
+CVE-2024-1055 (The PowerPack Addons for Elementor (Free Widgets, Extensions and Templ ...)
+	TODO: check
+CVE-2024-1037 (The All-In-One Security (AIOS) \u2013 Security and Firewall plugin for ...)
+	TODO: check
+CVE-2024-0977 (The Timeline Widget For Elementor (Elementor Timeline, Vertical & Hori ...)
+	TODO: check
+CVE-2024-0971 (A SQL injection vulnerability exists where an authenticated, low-privi ...)
+	TODO: check
+CVE-2024-0955 (A stored XSS vulnerability exists where an authenticated, remote attac ...)
+	TODO: check
+CVE-2024-0849 (Leanote version 2.7.0 allows obtaining arbitrary local files. This is  ...)
+	TODO: check
+CVE-2024-0628 (The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Sid ...)
+	TODO: check
+CVE-2024-0256 (The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Sc ...)
+	TODO: check
+CVE-2023-6388 (Suite CRM version 7.14.2 allows making arbitrary HTTP requests through ...)
+	TODO: check
+CVE-2023-5584
+	REJECTED
+CVE-2023-50395 (SQL Injection Remote Code Execution Vulnerability was found using an u ...)
+	TODO: check
+CVE-2023-47618 (A post authentication command execution vulnerability exists in the we ...)
+	TODO: check
+CVE-2023-47617 (A post authentication command injection vulnerability exists when conf ...)
+	TODO: check
+CVE-2023-47209 (A post authentication command injection vulnerability exists in the ip ...)
+	TODO: check
+CVE-2023-47167 (A post authentication command injection vulnerability exists in the GR ...)
+	TODO: check
+CVE-2023-46683 (A  post authentication command injection vulnerability exists when con ...)
+	TODO: check
+CVE-2023-46183 (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW ...)
+	TODO: check
+CVE-2023-45735 (A potential attacker with access to the Westermo Lynx device may be ab ...)
+	TODO: check
+CVE-2023-45227 (An attacker with access to the web application with vulnerable softwar ...)
+	TODO: check
+CVE-2023-45222 (An attacker with access to the web application that has the vulnerable ...)
+	TODO: check
+CVE-2023-45213 (A potential attacker with access to the Westermo Lynx device would be  ...)
+	TODO: check
+CVE-2023-43482 (A command execution vulnerability exists in the guest resource functio ...)
+	TODO: check
+CVE-2023-42765 (An attacker with access to the vulnerable software could introduce arb ...)
+	TODO: check
+CVE-2023-42664 (A post authentication command injection vulnerability exists when sett ...)
+	TODO: check
+CVE-2023-40545 (Authenticationbypass when an OAuth2 Client is using client_secret_jwt  ...)
+	TODO: check
+CVE-2023-40544 (An attacker with access to the network where the affected devices are  ...)
+	TODO: check
+CVE-2023-40355 (Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 b ...)
+	TODO: check
+CVE-2023-40143 (An attacker with access to the Westermo Lynx web application that has  ...)
+	TODO: check
+CVE-2023-38579 (The cross-site request forgery token in the request may be predictable ...)
+	TODO: check
+CVE-2023-36498 (A post-authentication command injection vulnerability exists in the PP ...)
+	TODO: check
+CVE-2023-35188 (SQL Injection Remote Code Execution Vulnerability was found using a cr ...)
+	TODO: check
 CVE-2024-1271 [privileges escalation from root to domain admin]
 	- freeipa <undetermined>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2262978
 	TODO: only little information in RHBZ#2262978
-CVE-2024-24577 [arbitrary code execution due to heap corruption in git_index_add]
+CVE-2024-24577 (libgit2 is a portable C implementation of the Git core methods provide ...)
 	- libgit2 <unfixed>
 	NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/eb4c1716cd92bf56f2770653a915d5fc01eab8f3 (v1.6.5)
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/487af0cf6687dc48b0a960fa2f39894e2d84d77b (v1.7.2)
-CVE-2024-24575 [potential infiniate loop condition in git_revparse_single]
+CVE-2024-24575 (libgit2 is a portable C implementation of the Git core methods provide ...)
 	- libgit2 <unfixed>
 	[bullseye] - libgit2 <not-affected> (Vulnerable code introduced later)
 	[buster] - libgit2 <not-affected> (Vulnerable code introduced later)
@@ -15,15 +205,15 @@ CVE-2024-24575 [potential infiniate loop condition in git_revparse_single]
 	NOTE: Introduced by: https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa (v1.4.0)
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/c9d31b711e8906cf248566f43142f20b03e20cbf (v1.6.5)
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/7f6f3dff9c41f3be7598693aa3c716c8354fba7f (v1.7.2)
-CVE-2024-1284
+CVE-2024-1284 (Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowe ...)
 	- chromium <unfixed>
 	[bullseye] - chromium <end-of-life> (see #1061268)
 	[buster] - chromium <end-of-life> (see DSA 5046)
-CVE-2024-1283
+CVE-2024-1283 (Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160  ...)
 	- chromium <unfixed>
 	[bullseye] - chromium <end-of-life> (see #1061268)
 	[buster] - chromium <end-of-life> (see DSA 5046)
-CVE-2024-24680 [Potential denial-of-service in intcomma template filter]
+CVE-2024-24680 (An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10 ...)
 	- python-django 3:4.2.10-1
 	NOTE: https://www.openwall.com/lists/oss-security/2024/02/06/2
 	NOTE: https://www.djangoproject.com/weblog/2024/feb/06/security-releases/
@@ -31,7 +221,7 @@ CVE-2024-24680 [Potential denial-of-service in intcomma template filter]
 	NOTE: https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc (5.0.2)
 	NOTE: https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2 (4.2.10)
 	NOTE: https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820 (3.2.24)
-CVE-2024-1048
+CVE-2024-1048 (A flaw was found in the grub2-set-bootflag utility of grub2. After the ...)
 	- grub2 <not-affected> (Red Hat-specific extension)
 	NOTE: https://www.openwall.com/lists/oss-security/2024/02/06/3
 CVE-2024-24808 (pyLoad is an open-source Download Manager written in pure Python. Ther ...)
@@ -2099,7 +2289,7 @@ CVE-2024-0914 (A timing side-channel vulnerability has been discovered in the op
 	NOTE: Fixed by: https://github.com/opencryptoki/opencryptoki/commit/7ffc0e135b4d923d686be536aa7bf69405a360a1
 	NOTE: Fixed by: https://github.com/opencryptoki/opencryptoki/commit/c26e049bf40d656bc51429bad190b82fbf63f0c7
 	NOTE: https://people.redhat.com/~hkario/marvin/
-CVE-2024-0911
+CVE-2024-0911 (A flaw was found in Indent. This issue may allow a local user to use a ...)
 	- indent 2.2.13-4 (unimportant; bug #1061543)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2259883
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2260399
@@ -3343,7 +3533,7 @@ CVE-2023-35020 (IBM Sterling Control Center 6.3.0 could allow a remote attacker
 	NOT-FOR-US: IBM
 CVE-2023-32337 (IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side  ...)
 	NOT-FOR-US: IBM
-CVE-2024-0690 [possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration]
+CVE-2024-0690 (An information disclosure flaw was found in ansible-core due to a fail ...)
 	- ansible-core <unfixed> (bug #1061156)
 	[bookworm] - ansible-core <no-dsa> (Minor issue)
 	- ansible 5.4.0-1
@@ -3352,7 +3542,7 @@ CVE-2024-0690 [possible information leak in tasks that ignore ANSIBLE_NO_LOG con
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2259013
 	NOTE: https://github.com/ansible/ansible/pull/82565
 	NOTE: https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1 (stable-2.14)
-CVE-2024-0684 [heap overflow in split --line-bytes with very long lines]
+CVE-2024-0684 (A flaw was found in the GNU coreutils "split" program. A heap overflow ...)
 	- coreutils <unfixed> (bug #1061138)
 	[bookworm] - coreutils <not-affected> (Vulnerable code not present)
 	[bullseye] - coreutils <not-affected> (Vulnerable code not present)
@@ -5086,6 +5276,7 @@ CVE-2023-42865 (An out-of-bounds read was addressed with improved input validati
 CVE-2023-42862 (An out-of-bounds read was addressed with improved input validation. Th ...)
 	NOT-FOR-US: Apple
 CVE-2023-42833 (A correctness issue was addressed with improved checks. This issue is  ...)
+	{DSA-5241-1 DSA-5240-1 DLA-3124-1}
 	- webkit2gtk 2.38.0-1
 	- wpewebkit 2.38.0-1
 	NOTE: https://webkitgtk.org/security/WSA-2024-0001.html
@@ -5126,6 +5317,7 @@ CVE-2023-40433 (A logic issue was addressed with improved checks. This issue is
 CVE-2023-40430 (A logic issue was addressed with improved checks. This issue is fixed  ...)
 	NOT-FOR-US: Apple
 CVE-2023-40414 (A use-after-free issue was addressed with improved memory management.  ...)
+	{DSA-5527-1}
 	- webkit2gtk 2.42.1-1
 	[buster] - webkit2gtk <end-of-life> (EOL in buster LTS)
 	- wpewebkit 2.42.1-1
@@ -12362,7 +12554,7 @@ CVE-2023-33018 (Memory corruption while using the UIM diag command to get the op
 	NOT-FOR-US: Qualcomm
 CVE-2023-33017 (Memory corruption in Boot while running a ListVars test in UEFI Menu d ...)
 	NOT-FOR-US: Qualcomm
-CVE-2023-4503
+CVE-2023-4503 (An improper initialization vulnerability was found in Galleon. When us ...)
 	NOT-FOR-US: Red Hat EAP-Galleon
 CVE-2023-6484
 	NOT-FOR-US: Keycloak
@@ -88550,7 +88742,7 @@ CVE-2022-38075 (Cross-Site Request Forgery (CSRF) vulnerability leading to Store
 	NOT-FOR-US: WordPress plugin
 CVE-2022-3648
 	RESERVED
-CVE-2022-3647 (A vulnerability, which was classified as problematic, was found in Red ...)
+CVE-2022-3647 (** DISPUTED ** A vulnerability, which was classified as problematic, w ...)
 	- redis <unfixed> (unimportant)
 	NOTE: https://github.com/redis/redis/commit/0bf90d944313919eb8e63d3588bf63a367f020a3
 	NOTE: Crash inside the crash report when redis already crashed due to calling an invalid
@@ -545479,7 +545671,7 @@ CVE-2014-1746 (The InMemoryUrlProtocol::Read function in media/filters/in_memory
 	- chromium-browser 35.0.1916.114-1
 	[squeeze] - chromium-browser <end-of-life>
 CVE-2014-1745 (Use-after-free vulnerability in the SVG implementation in Blink, as us ...)
-	{DSA-2939-1}
+	{DSA-5527-1 DSA-2939-1}
 	- chromium-browser 35.0.1916.114-1
 	- webkit2gtk 2.42.0-1
 	- wpewebkit 2.42.0-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/935efbf2e734c54ed39ab046af0bb7525e274a1c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/935efbf2e734c54ed39ab046af0bb7525e274a1c
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240207/26e32024/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list