[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
91d73b3b by Moritz Muehlenhoff at 2024-06-05T09:55:14+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -14,15 +14,15 @@ CVE-2024-4520 (An improper access control vulnerability exists in the gaizhenbia
 CVE-2024-4254 (The 'deploy-website.yml' workflow in the gradio-app/gradio repository, ...)
 	NOT-FOR-US: Gradio
 CVE-2024-37273 (An arbitrary file upload vulnerability in the /v1/app/appendFileSync i ...)
-	TODO: check
+	NOT-FOR-US: Jan
 CVE-2024-37065 (Deserialization of untrusted data can occur in versions 0.6 or newer o ...)
-	TODO: check
+	NOT-FOR-US: Skops
 CVE-2024-37064 (Deseriliazation of untrusted data can occur in versions 3.7.0 or newer ...)
-	TODO: check
+	NOT-FOR-US: ydata-profiling
 CVE-2024-37063 (A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer  ...)
-	TODO: check
+	NOT-FOR-US: ydata-profiling
 CVE-2024-37062 (Deserialization of untrusted data can occur in versions 3.7.0 or newer ...)
-	TODO: check
+	NOT-FOR-US: ydata-profiling
 CVE-2024-37061 (Remote Code Execution can occur in versions of the MLflow platform run ...)
 	NOT-FOR-US: mlflow
 CVE-2024-37060 (Deserialization of untrusted data can occur in versions of the MLflow  ...)
@@ -44,9 +44,9 @@ CVE-2024-37053 (Deserialization of untrusted data can occur in versions of the M
 CVE-2024-37052 (Deserialization of untrusted data can occur in versions of the MLflow  ...)
 	NOT-FOR-US: mlflow
 CVE-2024-36858 (An arbitrary file upload vulnerability in the /v1/app/writeFileSync in ...)
-	TODO: check
+	NOT-FOR-US: Jan
 CVE-2024-36857 (Jan v0.4.12 was discovered to contain an arbitrary file read vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Jan
 CVE-2024-36801 (A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacke ...)
 	NOT-FOR-US: SEMCMS
 CVE-2024-36800 (A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacke ...)
@@ -62,7 +62,7 @@ CVE-2024-36548 (idccms V1.35 was discovered to contain a Cross-Site Request Forg
 CVE-2024-36547 (idccms V1.35 was discovered to contain a Cross-Site Request Forgery (C ...)
 	NOT-FOR-US: idccms
 CVE-2024-36400 (nano-id is a unique string ID generator for Rust. Affected versions of ...)
-	TODO: check
+	NOT-FOR-US: Rust crate nano-id
 CVE-2024-35782 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-35700 (Improper Privilege Management vulnerability in DeluxeThemes Userpro al ...)
@@ -140,7 +140,7 @@ CVE-2024-25095 (Insertion of Sensitive Information into Log File vulnerability i
 CVE-2024-0756 (The Insert or Embed Articulate Content into WordPress plugin through 4 ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2023-5751 (A local attacker with low privileges can read and modify any users fil ...)
-	TODO: check
+	NOT-FOR-US: CODESYS
 CVE-2023-52176 (Authentication Bypass by Spoofing vulnerability in miniorange Malware  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2023-52147 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
@@ -637,7 +637,7 @@ CVE-2024-1324 (The QQWorld Auto Save Images plugin for WordPress is vulnerable t
 CVE-2023-6382 (The Master Slider \u2013 Responsive Touch Slider plugin for WordPress  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-5565 (The Vanna library uses a prompt function to present the user with visu ...)
-	TODO: check
+	NOT-FOR-US: Vanna
 CVE-2024-5564 (A vulnerability was found in libndp. This flaw allows a local maliciou ...)
 	- libndp <unfixed> (bug #1072366)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2284122
@@ -674,7 +674,7 @@ CVE-2024-36843 (libmodbus v3.1.6 was discovered to contain a heap overflow via t
 	[bullseye] - libmodbus <no-dsa> (Minor issue)
 	NOTE: https://github.com/stephane/libmodbus/issues/748
 CVE-2024-36120 (javascript-deobfuscator removes common JavaScript obfuscation techniqu ...)
-	TODO: check
+	NOT-FOR-US: javascript-deobfuscator
 CVE-2024-36108 (casgate is an Open Source Identity and Access Management system. In af ...)
 	NOT-FOR-US: casgate
 CVE-2024-35196 (Sentry is a developer-first error tracking and performance monitoring  ...)
@@ -89566,6 +89566,7 @@ CVE-2023-1420 (The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search
 	NOT-FOR-US: WordPress plugin
 CVE-2023-1419
 	RESERVED
+	NOT-FOR-US: Debezium
 CVE-2023-1418 (A vulnerability classified as problematic was found in SourceCodester  ...)
 	NOT-FOR-US: SourceCodester Friendly Island Pizza Website and Ordering System
 CVE-2023-1417 (An issue has been discovered in GitLab affecting all versions starting ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91d73b3b3f09d70c16fcafa049b28ea5be88ef43

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91d73b3b3f09d70c16fcafa049b28ea5be88ef43
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240605/903c8d27/attachment.htm>