[Git][security-tracker-team/security-tracker][master] automatic update

Fri Jul 19 21:12:05 BST 2024


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0d737e8f by security tracker role at 2024-07-19T20:11:49+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,71 @@
+CVE-2024-6916 (A vulnerability in Zowe CLI allows local, privileged actors to display ...)
+	TODO: check
+CVE-2024-6908 (Improper privilege management in Yugabyte Platform allows authenticate ...)
+	TODO: check
+CVE-2024-6907 (A vulnerability was found in SourceCodester Record Management System 1 ...)
+	TODO: check
+CVE-2024-6906 (A vulnerability was found in SourceCodester Record Management System 1 ...)
+	TODO: check
+CVE-2024-6905 (A vulnerability has been found in SourceCodester Record Management Sys ...)
+	TODO: check
+CVE-2024-6904 (A vulnerability, which was classified as critical, was found in Source ...)
+	TODO: check
+CVE-2024-6895 (Insufficient authentication in user account management in Yugabyte Pla ...)
+	TODO: check
+CVE-2024-5977 (The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for  ...)
+	TODO: check
+CVE-2024-41603 (Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forge ...)
+	TODO: check
+CVE-2024-41602 (Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and bef ...)
+	TODO: check
+CVE-2024-41601 (Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allow ...)
+	TODO: check
+CVE-2024-41600 (Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and b ...)
+	TODO: check
+CVE-2024-41599 (Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows  ...)
+	TODO: check
+CVE-2024-41597 (Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allo ...)
+	TODO: check
+CVE-2024-41492 (A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a  ...)
+	TODO: check
+CVE-2024-41281 (Linksys WRT54G v4.21.5 has a stack overflow vulnerability in get_merge ...)
+	TODO: check
+CVE-2024-41172 (In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower vers ...)
+	TODO: check
+CVE-2024-41124 (Puncia is the Official CLI utility for Subdomain Center & Exploit Obse ...)
+	TODO: check
+CVE-2024-41122 (Woodpecker is a simple yet powerful CI/CD engine with great extensibil ...)
+	TODO: check
+CVE-2024-41121 (Woodpecker is a simple yet powerful CI/CD engine with great extensibil ...)
+	TODO: check
+CVE-2024-41107 (The CloudStack SAML authentication (disabled by default) does not enfo ...)
+	TODO: check
+CVE-2024-40400 (An arbitrary file upload vulnerability in the image upload function of ...)
+	TODO: check
+CVE-2024-39963 (AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Du ...)
+	TODO: check
+CVE-2024-39962 (D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 w ...)
+	TODO: check
+CVE-2024-39906 (A command injection vulnerability was found in the IndieAuth functiona ...)
+	TODO: check
+CVE-2024-39457 (Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerabi ...)
+	TODO: check
+CVE-2024-39123 (In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments functi ...)
+	TODO: check
+CVE-2024-37066 (A command injection vulnerability exists in Wyze V4 Pro firmware versi ...)
+	TODO: check
+CVE-2024-32007 (An improper input validation of thep2c parameter in the Apache CXF JOS ...)
+	TODO: check
+CVE-2024-29736 (A SSRF vulnerability in WADL service description in versions of Apache ...)
+	TODO: check
+CVE-2024-29080 (Potential vulnerabilities have been identified in the HP Display Contr ...)
+	TODO: check
+CVE-2024-27489 (An issue in the DelFile() function of WMCMS v4.4 allows attackers to d ...)
+	TODO: check
+CVE-2024-24970 (Potential vulnerabilities have been identified in the HP Display Contr ...)
+	TODO: check
+CVE-2024-0006 (Information exposure in the logging system in Yugabyte Platform allows ...)
+	TODO: check
 CVE-2024-6903 (A vulnerability, which was classified as critical, has been found in S ...)
 	NOT-FOR-US: SourceCodester Record Management System
 CVE-2024-6902 (A vulnerability classified as critical was found in SourceCodester Rec ...)
@@ -502,18 +570,24 @@ CVE-2024-21122 (Vulnerability in the PeopleSoft Enterprise HCM Shared Components
 CVE-2024-20996 (Vulnerability in the MySQL Server product of Oracle MySQL (component:  ...)
 	- mysql-8.0 8.0.38-1
 CVE-2023-7013 (Inappropriate implementation in Compositing in Google Chrome prior to  ...)
+	{DSA-5546-1}
 	- chromium 119.0.6045.105-1
 CVE-2023-7012 (Insufficient data validation in Permission Prompts in Google Chrome pr ...)
+	{DSA-5499-1}
 	- chromium 117.0.5938.62-1
 CVE-2023-7011 (Inappropriate implementation in Picture in Picture in Google Chrome pr ...)
+	{DSA-5546-1}
 	- chromium 119.0.6045.105-1
 CVE-2023-7010 (Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allow ...)
+	{DSA-5499-1}
 	- chromium 117.0.5938.62-1
 CVE-2023-4860 (Inappropriate implementation in Skia in Google Chrome prior to 115.0.5 ...)
 	TODO: check
 CVE-2020-36765 (Insufficient policy enforcement in Navigation in Google Chrome prior t ...)
+	{DSA-4824-1}
 	- chromium 87.0.4280.88-0.1
 CVE-2019-25154 (Inappropriate implementation in iframe in Google Chrome prior to 77.0. ...)
+	{DSA-4562-1}
 	- chromium 78.0.3904.87-1
 CVE-2024-41010 (In the Linux kernel, the following vulnerability has been resolved:  b ...)
 	- linux 6.9.10-1
@@ -51436,7 +51510,8 @@ CVE-2024-23334 (aiohttp is an asynchronous HTTP client/server framework for asyn
 	NOTE: https://github.com/aio-libs/aiohttp/commit/9118a5831e8a65b8c839eb7e4ac983e040ff41df (v3.9.2)
 CVE-2024-22938 (Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local a ...)
 	NOT-FOR-US: BossCMS
-CVE-2024-22682 (DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to ...)
+CVE-2024-22682
+	REJECTED
 	NOT-FOR-US: DuckDB
 CVE-2024-22648 (A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionali ...)
 	NOT-FOR-US: SEO Panel



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d737e8f44366c7ca0e47c3a631c5232d6bd82d2

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d737e8f44366c7ca0e47c3a631c5232d6bd82d2
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240719/d4a02d20/attachment-0001.htm>
