[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Jun 6 21:12:30 BST 2024 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
681bd296 by security tracker role at 2024-06-06T20:12:16+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,263 @@
+CVE-2024-5684 (An attacker with access to the private network (the charger is connect ...)
+	TODO: check
+CVE-2024-5675 (Untrusted data deserialization vulnerability has been found in Mentor  ...)
+	TODO: check
+CVE-2024-5673 (Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8.  ...)
+	TODO: check
+CVE-2024-5658 (The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reu ...)
+	TODO: check
+CVE-2024-5657 (The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 ...)
+	TODO: check
+CVE-2024-5609
+	REJECTED
+CVE-2024-5552 (kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Serv ...)
+	TODO: check
+CVE-2024-5550 (In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information  ...)
+	TODO: check
+CVE-2024-5509 (Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remot ...)
+	TODO: check
+CVE-2024-5508 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
+	TODO: check
+CVE-2024-5507 (Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Rem ...)
+	TODO: check
+CVE-2024-5506 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
+	TODO: check
+CVE-2024-5505 (NETGEAR ProSAFE Network Management System UpLoadServlet Directory Trav ...)
+	TODO: check
+CVE-2024-5489 (The Wbcom Designs \u2013 Custom Font Uploader plugin for WordPress is  ...)
+	TODO: check
+CVE-2024-5482 (A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_ ...)
+	TODO: check
+CVE-2024-5480 (A vulnerability in the PyTorch's torch.distributed.rpc framework, spec ...)
+	TODO: check
+CVE-2024-5478 (A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata ...)
+	TODO: check
+CVE-2024-5452 (A remote code execution (RCE) vulnerability exists in the lightning-ai ...)
+	TODO: check
+CVE-2024-5329 (The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) ...)
+	TODO: check
+CVE-2024-5328 (A Server-Side Request Forgery (SSRF) vulnerability exists in the lunar ...)
+	TODO: check
+CVE-2024-5307 (Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Dis ...)
+	TODO: check
+CVE-2024-5306 (Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Executi ...)
+	TODO: check
+CVE-2024-5305 (Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Co ...)
+	TODO: check
+CVE-2024-5304 (Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execu ...)
+	TODO: check
+CVE-2024-5303 (Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execu ...)
+	TODO: check
+CVE-2024-5302 (Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execu ...)
+	TODO: check
+CVE-2024-5301 (Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Cod ...)
+	TODO: check
+CVE-2024-5278 (gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file uploa ...)
+	TODO: check
+CVE-2024-5277 (In lunary-ai/lunary version 1.2.4, a vulnerability exists in the passw ...)
+	TODO: check
+CVE-2024-5269 (Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Executi ...)
+	TODO: check
+CVE-2024-5268 (Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Dis ...)
+	TODO: check
+CVE-2024-5267 (Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Ex ...)
+	TODO: check
+CVE-2024-5259 (The MultiVendorX Marketplace \u2013 WooCommerce MultiVendor Marketplac ...)
+	TODO: check
+CVE-2024-5256 (Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disc ...)
+	TODO: check
+CVE-2024-5248 (In lunary-ai/lunary version 1.2.5, an improper access control vulnerab ...)
+	TODO: check
+CVE-2024-5225 (An SQL Injection vulnerability exists in the berriai/litellm repositor ...)
+	TODO: check
+CVE-2024-5221 (The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site  ...)
+	TODO: check
+CVE-2024-5206 (A sensitive data leakage vulnerability was identified in scikit-learn' ...)
+	TODO: check
+CVE-2024-5188 (The Essential Addons for Elementor \u2013 Best Elementor Templates, Wi ...)
+	TODO: check
+CVE-2024-5187 (A vulnerability in the `download_model_with_test_data` function of the ...)
+	TODO: check
+CVE-2024-5186 (A Server-Side Request Forgery (SSRF) vulnerability exists in the file  ...)
+	TODO: check
+CVE-2024-5133 (In lunary-ai/lunary version 1.2.4, an account takeover vulnerability e ...)
+	TODO: check
+CVE-2024-5132 (In lunary-ai/lunary version 1.2.2, a business logic error allows users ...)
+	TODO: check
+CVE-2024-5131 (An Improper Access Control vulnerability exists in the lunary-ai/lunar ...)
+	TODO: check
+CVE-2024-5130 (An Incorrect Authorization vulnerability exists in lunary-ai/lunary ve ...)
+	TODO: check
+CVE-2024-5129 (A Privilege Escalation Vulnerability exists in lunary-ai/lunary versio ...)
+	TODO: check
+CVE-2024-5128 (An Insecure Direct Object Reference (IDOR) vulnerability was identifie ...)
+	TODO: check
+CVE-2024-5127 (In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access  ...)
+	TODO: check
+CVE-2024-5126 (An improper access control vulnerability exists in the lunary-ai/lunar ...)
+	TODO: check
+CVE-2024-5124 (A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt ...)
+	TODO: check
+CVE-2024-5089
+	REJECTED
+CVE-2024-5038 (The Colibri Page Builder plugin for WordPress is vulnerable to Stored  ...)
+	TODO: check
+CVE-2024-4941 (A local file inclusion vulnerability exists in the JSON component of g ...)
+	TODO: check
+CVE-2024-4890 (A blind SQL injection vulnerability exists in the berriai/litellm appl ...)
+	TODO: check
+CVE-2024-4889 (A code injection vulnerability exists in the berriai/litellm applicati ...)
+	TODO: check
+CVE-2024-4888 (BerriAI's litellm, in its latest version, is vulnerable to arbitrary f ...)
+	TODO: check
+CVE-2024-4881 (A path traversal vulnerability exists in the parisneo/lollms applicati ...)
+	TODO: check
+CVE-2024-4851 (A Server-Side Request Forgery (SSRF) vulnerability exists in the stang ...)
+	TODO: check
+CVE-2024-4325 (A Server-Side Request Forgery (SSRF) vulnerability exists in the gradi ...)
+	TODO: check
+CVE-2024-4320 (A remote code execution (RCE) vulnerability exists in the '/install_ex ...)
+	TODO: check
+CVE-2024-3504 (An improper access control vulnerability exists in lunary-ai/lunary ve ...)
+	TODO: check
+CVE-2024-3429 (A path traversal vulnerability exists in the parisneo/lollms applicati ...)
+	TODO: check
+CVE-2024-3408 (man-group/dtale version 3.10.0 is vulnerable to an authentication bypa ...)
+	TODO: check
+CVE-2024-3404 (In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 2024 ...)
+	TODO: check
+CVE-2024-3402 (A stored Cross-Site Scripting (XSS) vulnerability existed in version ( ...)
+	TODO: check
+CVE-2024-3322 (A path traversal vulnerability exists in the 'cyber_security/codeguard ...)
+	TODO: check
+CVE-2024-3234 (The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path tra ...)
+	TODO: check
+CVE-2024-3166 (A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/any ...)
+	TODO: check
+CVE-2024-3153 (mintplex-labs/anything-llm is affected by an uncontrolled resource con ...)
+	TODO: check
+CVE-2024-3152 (mintplex-labs/anything-llm is vulnerable to multiple security issues d ...)
+	TODO: check
+CVE-2024-3150 (In mintplex-labs/anything-llm, a vulnerability exists in the thread up ...)
+	TODO: check
+CVE-2024-3149 (A Server-Side Request Forgery (SSRF) vulnerability exists in the uploa ...)
+	TODO: check
+CVE-2024-3110 (A stored Cross-Site Scripting (XSS) vulnerability exists in the mintpl ...)
+	TODO: check
+CVE-2024-3104 (A remote code execution vulnerability exists in mintplex-labs/anything ...)
+	TODO: check
+CVE-2024-3102 (A JSON Injection vulnerability exists in the `mintplex-labs/anything-l ...)
+	TODO: check
+CVE-2024-3099 (A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to cr ...)
+	TODO: check
+CVE-2024-3095 (A Server-Side Request Forgery (SSRF) vulnerability exists in the Web R ...)
+	TODO: check
+CVE-2024-3033 (An improper authorization vulnerability exists in the mintplex-labs/an ...)
+	TODO: check
+CVE-2024-37364 (Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kio ...)
+	TODO: check
+CVE-2024-37156 (The SuluFormBundle adds support for creating dynamic forms in Sulu Adm ...)
+	TODO: check
+CVE-2024-37154 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
+	TODO: check
+CVE-2024-37153 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
+	TODO: check
+CVE-2024-37152 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
+	TODO: check
+CVE-2024-37150 (An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno  ...)
+	TODO: check
+CVE-2024-36779 (Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injec ...)
+	TODO: check
+CVE-2024-36745 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
+	TODO: check
+CVE-2024-36743 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
+	TODO: check
+CVE-2024-36742 (An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9 ...)
+	TODO: check
+CVE-2024-36740 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
+	TODO: check
+CVE-2024-36737 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
+	TODO: check
+CVE-2024-36736 (An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9 ...)
+	TODO: check
+CVE-2024-36735 (OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when  ...)
+	TODO: check
+CVE-2024-36734 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
+	TODO: check
+CVE-2024-36732 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
+	TODO: check
+CVE-2024-36730 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
+	TODO: check
+CVE-2024-36399 (Kanboard is project management software that focuses on the Kanban met ...)
+	TODO: check
+CVE-2024-36394 (SysAid - CWE-78: Improper Neutralization of Special Elements used in a ...)
+	TODO: check
+CVE-2024-36393 (SysAid - CWE-89: Improper Neutralization of Special Elements used in a ...)
+	TODO: check
+CVE-2024-36106 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
+	TODO: check
+CVE-2024-35178 (The Jupyter Server provides the backend for Jupyter web applications.  ...)
+	TODO: check
+CVE-2024-34832 (Directory Traversal vulnerability in CubeCart v.6.5.5 and before allow ...)
+	TODO: check
+CVE-2024-32873 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
+	TODO: check
+CVE-2024-30375 (Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Exec ...)
+	TODO: check
+CVE-2024-30374 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
+	TODO: check
+CVE-2024-30373 (Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execu ...)
+	TODO: check
+CVE-2024-30369 (A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escala ...)
+	TODO: check
+CVE-2024-30368 (A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution ...)
+	TODO: check
+CVE-2024-2965 (A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader`  ...)
+	TODO: check
+CVE-2024-2928 (A Local File Inclusion (LFI) vulnerability was identified in mlflow/ml ...)
+	TODO: check
+CVE-2024-2914 (A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting v ...)
+	TODO: check
+CVE-2024-2624 (A path traversal and arbitrary file upload vulnerability exists in the ...)
+	TODO: check
+CVE-2024-2548 (A path traversal vulnerability exists in the parisneo/lollms-webui app ...)
+	TODO: check
+CVE-2024-2383 (A clickjacking vulnerability exists in zenml-io/zenml versions up to a ...)
+	TODO: check
+CVE-2024-2362 (A path traversal vulnerability exists in the parisneo/lollms-webui ver ...)
+	TODO: check
+CVE-2024-2360 (parisneo/lollms-webui is vulnerable to path traversal attacks that can ...)
+	TODO: check
+CVE-2024-2359 (A vulnerability in the parisneo/lollms-webui version 9.3 allows attack ...)
+	TODO: check
+CVE-2024-2288 (A Cross-Site Request Forgery (CSRF) vulnerability exists in the profil ...)
+	TODO: check
+CVE-2024-2213 (An issue was discovered in zenml-io/zenml versions up to and including ...)
+	TODO: check
+CVE-2024-2171 (A stored Cross-Site Scripting (XSS) vulnerability was identified in th ...)
+	TODO: check
+CVE-2024-2035 (An improper authorization vulnerability exists in the zenml-io/zenml r ...)
+	TODO: check
+CVE-2024-2032 (A race condition vulnerability exists in zenml-io/zenml versions up to ...)
+	TODO: check
+CVE-2024-28995 (SolarWinds Serv-U was susceptible to a directory transversal vulnerabi ...)
+	TODO: check
+CVE-2024-23793 (The file upload feature in OTRS and ((OTRS)) Community Edition has a p ...)
+	TODO: check
+CVE-2024-22326 (IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.4 ...)
+	TODO: check
+CVE-2024-1881 (AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to ...)
+	TODO: check
+CVE-2024-1880 (An OS command injection vulnerability exists in the MacOS Text-To-Spee ...)
+	TODO: check
+CVE-2024-1879 (A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravi ...)
+	TODO: check
+CVE-2024-1873 (parisneo/lollms-webui is vulnerable to path traversal and denial of se ...)
+	TODO: check
+CVE-2024-0520 (A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code  ...)
+	TODO: check
+CVE-2023-45192 (IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is  ...)
+	TODO: check
 CVE-2024-5665 (The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPr ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-5656 (The Google CSE plugin for WordPress is vulnerable to Stored Cross-Site ...)
@@ -10172,7 +10432,7 @@ CVE-2024-0445 (The The Plus Addons for Elementor plugin for WordPress is vulnera
 	NOT-FOR-US: WordPress plugin
 CVE-2023-6327 (The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable ...)
 	NOT-FOR-US: WordPress plugin
-CVE-2024-33655
+CVE-2024-33655 (The DNS protocol in RFC 1035 and updates allows remote attackers to ca ...)
 	- unbound 1.20.0-1
 	NOTE: https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
 	NOTE: Fixed by: https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de (release-1.20.0rc1)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/681bd296145d9fabea7ccd4bf080c3b06b19936b

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/681bd296145d9fabea7ccd4bf080c3b06b19936b
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240606/c86ad889/attachment.htm>

More information about the debian-security-tracker-commits mailing list