[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Jun 6 21:30:14 BST 2024 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0feb2379 by Salvatore Bonaccorso at 2024-06-06T22:29:37+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
 CVE-2024-5684 (An attacker with access to the private network (the charger is connect ...)
-	TODO: check
+	NOT-FOR-US: ID Charger Connect and Pro from Volkswagen Group Charging GmbH - Elli, EVBox
 CVE-2024-5675 (Untrusted data deserialization vulnerability has been found in Mentor  ...)
-	TODO: check
+	NOT-FOR-US: Mentor
 CVE-2024-5673 (Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8.  ...)
-	TODO: check
+	NOT-FOR-US: Dulldusk's PHP File Manager
 CVE-2024-5658 (The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reu ...)
-	TODO: check
+	NOT-FOR-US: CraftCMS plugin
 CVE-2024-5657 (The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 ...)
-	TODO: check
+	NOT-FOR-US: CraftCMS plugin
 CVE-2024-5609
 	REJECTED
 CVE-2024-5552 (kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Serv ...)
@@ -15,95 +15,95 @@ CVE-2024-5552 (kubeflow/kubeflow is vulnerable to a Regular Expression Denial of
 CVE-2024-5550 (In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information  ...)
 	TODO: check
 CVE-2024-5509 (Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remot ...)
-	TODO: check
+	NOT-FOR-US: KeyShot
 CVE-2024-5508 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
-	TODO: check
+	NOT-FOR-US: KeyShot
 CVE-2024-5507 (Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Rem ...)
-	TODO: check
+	NOT-FOR-US: KeyShot
 CVE-2024-5506 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
-	TODO: check
+	NOT-FOR-US: KeyShot
 CVE-2024-5505 (NETGEAR ProSAFE Network Management System UpLoadServlet Directory Trav ...)
-	TODO: check
+	NOT-FOR-US: NETGEAR
 CVE-2024-5489 (The Wbcom Designs \u2013 Custom Font Uploader plugin for WordPress is  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-5482 (A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_ ...)
-	TODO: check
+	NOT-FOR-US: parisneo/lollms-webui
 CVE-2024-5480 (A vulnerability in the PyTorch's torch.distributed.rpc framework, spec ...)
 	TODO: check
 CVE-2024-5478 (A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5452 (A remote code execution (RCE) vulnerability exists in the lightning-ai ...)
 	TODO: check
 CVE-2024-5329 (The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-5328 (A Server-Side Request Forgery (SSRF) vulnerability exists in the lunar ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5307 (Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Dis ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5306 (Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Executi ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5305 (Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Co ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5304 (Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execu ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5303 (Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execu ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5302 (Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execu ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5301 (Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Cod ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-5278 (gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file uploa ...)
-	TODO: check
+	NOT-FOR-US: gaizhenbiao/chuanhuchatgpt
 CVE-2024-5277 (In lunary-ai/lunary version 1.2.4, a vulnerability exists in the passw ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5269 (Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Executi ...)
-	TODO: check
+	NOT-FOR-US: Sonos Era 100
 CVE-2024-5268 (Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Dis ...)
-	TODO: check
+	NOT-FOR-US: Sonos Era 100
 CVE-2024-5267 (Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Ex ...)
-	TODO: check
+	NOT-FOR-US: Sonos Era 100
 CVE-2024-5259 (The MultiVendorX Marketplace \u2013 WooCommerce MultiVendor Marketplac ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-5256 (Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disc ...)
-	TODO: check
+	NOT-FOR-US: Sonos Era 100
 CVE-2024-5248 (In lunary-ai/lunary version 1.2.5, an improper access control vulnerab ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5225 (An SQL Injection vulnerability exists in the berriai/litellm repositor ...)
 	TODO: check
 CVE-2024-5221 (The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-5206 (A sensitive data leakage vulnerability was identified in scikit-learn' ...)
 	TODO: check
 CVE-2024-5188 (The Essential Addons for Elementor \u2013 Best Elementor Templates, Wi ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-5187 (A vulnerability in the `download_model_with_test_data` function of the ...)
 	TODO: check
 CVE-2024-5186 (A Server-Side Request Forgery (SSRF) vulnerability exists in the file  ...)
 	TODO: check
 CVE-2024-5133 (In lunary-ai/lunary version 1.2.4, an account takeover vulnerability e ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5132 (In lunary-ai/lunary version 1.2.2, a business logic error allows users ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5131 (An Improper Access Control vulnerability exists in the lunary-ai/lunar ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5130 (An Incorrect Authorization vulnerability exists in lunary-ai/lunary ve ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5129 (A Privilege Escalation Vulnerability exists in lunary-ai/lunary versio ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5128 (An Insecure Direct Object Reference (IDOR) vulnerability was identifie ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5127 (In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access  ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5126 (An improper access control vulnerability exists in the lunary-ai/lunar ...)
-	TODO: check
+	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5124 (A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt ...)
 	TODO: check
 CVE-2024-5089
 	REJECTED
 CVE-2024-5038 (The Colibri Page Builder plugin for WordPress is vulnerable to Stored  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2024-4941 (A local file inclusion vulnerability exists in the JSON component of g ...)
-	TODO: check
+	NOT-FOR-US: Gradio
 CVE-2024-4890 (A blind SQL injection vulnerability exists in the berriai/litellm appl ...)
 	TODO: check
 CVE-2024-4889 (A code injection vulnerability exists in the berriai/litellm applicati ...)
@@ -111,7 +111,7 @@ CVE-2024-4889 (A code injection vulnerability exists in the berriai/litellm appl
 CVE-2024-4888 (BerriAI's litellm, in its latest version, is vulnerable to arbitrary f ...)
 	TODO: check
 CVE-2024-4881 (A path traversal vulnerability exists in the parisneo/lollms applicati ...)
-	TODO: check
+	NOT-FOR-US: parisneo/lollms
 CVE-2024-4851 (A Server-Side Request Forgery (SSRF) vulnerability exists in the stang ...)
 	TODO: check
 CVE-2024-4325 (A Server-Side Request Forgery (SSRF) vulnerability exists in the gradi ...)
@@ -340,7 +340,7 @@ CVE-2024-5571 (The EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embe
 CVE-2024-5536 (The GamiPress \u2013 Link plugin for WordPress is vulnerable to Stored ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-5526 (Grafana OnCall is an easy-to-use on-call management tool that will hel ...)
-	TODO: check
+	NOT-FOR-US: Grafana OnCall
 CVE-2024-5459 (The Restaurant Menu and Food Ordering plugin for WordPress is vulnerab ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-5184 (The EmailGPT service contains a prompt injection vulnerability.The ser ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0feb2379f24467d3f0ae469c7d8b4b5339d1b815

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0feb2379f24467d3f0ae469c7d8b4b5339d1b815
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240606/2bfc167b/attachment.htm>

More information about the debian-security-tracker-commits mailing list