[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Fri Jun 7 11:08:19 BST 2024 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ba21d61c by Moritz Muehlenhoff at 2024-06-07T12:07:53+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -120,7 +120,7 @@ CVE-2024-5609
 CVE-2024-5552 (kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Serv ...)
 	NOT-FOR-US: kubeflow
 CVE-2024-5550 (In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information  ...)
-	TODO: check
+	NOT-FOR-US: h2oai/h2o-3
 CVE-2024-5509 (Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remot ...)
 	NOT-FOR-US: KeyShot
 CVE-2024-5508 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
@@ -140,7 +140,7 @@ CVE-2024-5480 (A vulnerability in the PyTorch's torch.distributed.rpc framework,
 CVE-2024-5478 (A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata ...)
 	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5452 (A remote code execution (RCE) vulnerability exists in the lightning-ai ...)
-	TODO: check
+	NOT-FOR-US: pytorch-lightning
 CVE-2024-5329 (The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-5328 (A Server-Side Request Forgery (SSRF) vulnerability exists in the lunar ...)
@@ -186,7 +186,7 @@ CVE-2024-5188 (The Essential Addons for Elementor \u2013 Best Elementor Template
 CVE-2024-5187 (A vulnerability in the `download_model_with_test_data` function of the ...)
 	TODO: check
 CVE-2024-5186 (A Server-Side Request Forgery (SSRF) vulnerability exists in the file  ...)
-	TODO: check
+	NOT-FOR-US: privategpt
 CVE-2024-5133 (In lunary-ai/lunary version 1.2.4, an account takeover vulnerability e ...)
 	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5132 (In lunary-ai/lunary version 1.2.2, a business logic error allows users ...)
@@ -204,7 +204,7 @@ CVE-2024-5127 (In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper ac
 CVE-2024-5126 (An improper access control vulnerability exists in the lunary-ai/lunar ...)
 	NOT-FOR-US: lunary-ai/lunary
 CVE-2024-5124 (A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt ...)
-	TODO: check
+	NOT-FOR-US: gaizhenbiao/chuanhuchatgpt
 CVE-2024-5089
 	REJECTED
 CVE-2024-5038 (The Colibri Page Builder plugin for WordPress is vulnerable to Stored  ...)
@@ -220,7 +220,7 @@ CVE-2024-4888 (BerriAI's litellm, in its latest version, is vulnerable to arbitr
 CVE-2024-4881 (A path traversal vulnerability exists in the parisneo/lollms applicati ...)
 	NOT-FOR-US: parisneo/lollms
 CVE-2024-4851 (A Server-Side Request Forgery (SSRF) vulnerability exists in the stang ...)
-	TODO: check
+	NOT-FOR-US: stangirard/quivr
 CVE-2024-4325 (A Server-Side Request Forgery (SSRF) vulnerability exists in the gradi ...)
 	NOT-FOR-US: Gradio
 CVE-2024-4320 (A remote code execution (RCE) vulnerability exists in the '/install_ex ...)
@@ -230,71 +230,71 @@ CVE-2024-3504 (An improper access control vulnerability exists in lunary-ai/luna
 CVE-2024-3429 (A path traversal vulnerability exists in the parisneo/lollms applicati ...)
 	NOT-FOR-US: parisneo/lollms
 CVE-2024-3408 (man-group/dtale version 3.10.0 is vulnerable to an authentication bypa ...)
-	TODO: check
+	NOT-FOR-US: man-group/dtale
 CVE-2024-3404 (In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 2024 ...)
-	TODO: check
+	NOT-FOR-US: gaizhenbiao/chuanhuchatgpt
 CVE-2024-3402 (A stored Cross-Site Scripting (XSS) vulnerability existed in version ( ...)
-	TODO: check
+	NOT-FOR-US: gaizhenbiao/chuanhuchatgpt
 CVE-2024-3322 (A path traversal vulnerability exists in the 'cyber_security/codeguard ...)
-	TODO: check
+	NOT-FOR-US: lollms-webui
 CVE-2024-3234 (The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path tra ...)
-	TODO: check
+	NOT-FOR-US: gaizhenbiao/chuanhuchatgpt
 CVE-2024-3166 (A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/any ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3153 (mintplex-labs/anything-llm is affected by an uncontrolled resource con ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3152 (mintplex-labs/anything-llm is vulnerable to multiple security issues d ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3150 (In mintplex-labs/anything-llm, a vulnerability exists in the thread up ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3149 (A Server-Side Request Forgery (SSRF) vulnerability exists in the uploa ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3110 (A stored Cross-Site Scripting (XSS) vulnerability exists in the mintpl ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3104 (A remote code execution vulnerability exists in mintplex-labs/anything ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3102 (A JSON Injection vulnerability exists in the `mintplex-labs/anything-l ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-3099 (A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to cr ...)
-	TODO: check
+	NOT-FOR-US: mlflow
 CVE-2024-3095 (A Server-Side Request Forgery (SSRF) vulnerability exists in the Web R ...)
-	TODO: check
+	NOT-FOR-US: langchain-ai/langchain
 CVE-2024-3033 (An improper authorization vulnerability exists in the mintplex-labs/an ...)
-	TODO: check
+	NOT-FOR-US: anything-llm
 CVE-2024-37364 (Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kio ...)
 	NOT-FOR-US: Ariane Allegro Scenario Player
 CVE-2024-37156 (The SuluFormBundle adds support for creating dynamic forms in Sulu Adm ...)
-	TODO: check
+	NOT-FOR-US: SuluFormBundle
 CVE-2024-37154 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
-	TODO: check
+	NOT-FOR-US: Evmos
 CVE-2024-37153 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
-	TODO: check
+	NOT-FOR-US: Evmos
 CVE-2024-37152 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2024-37150 (An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno  ...)
-	TODO: check
+	NOT-FOR-US: Deno
 CVE-2024-36779 (Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injec ...)
 	NOT-FOR-US: Sourcecodester Stock Management System
 CVE-2024-36745 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36743 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36742 (An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9 ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36740 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36737 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36736 (An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9 ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36735 (OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when  ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36734 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36732 (An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a De ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36730 (Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attack ...)
-	TODO: check
+	NOT-FOR-US: OneFlow
 CVE-2024-36399 (Kanboard is project management software that focuses on the Kanban met ...)
 	- kanboard <unfixed>
 	NOTE: https://github.com/kanboard/kanboard/security/advisories/GHSA-x8v7-3ghx-65cv
@@ -310,17 +310,17 @@ CVE-2024-35178 (The Jupyter Server provides the backend for Jupyter web applicat
 CVE-2024-34832 (Directory Traversal vulnerability in CubeCart v.6.5.5 and before allow ...)
 	NOT-FOR-US: CubeCart
 CVE-2024-32873 (Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. ...)
-	TODO: check
+	NOT-FOR-US: Evmos
 CVE-2024-30375 (Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Exec ...)
-	TODO: check
+	NOT-FOR-US: Luxion KeyShot Viewer
 CVE-2024-30374 (Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code ...)
-	TODO: check
+	NOT-FOR-US: Luxion KeyShot Viewer
 CVE-2024-30373 (Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execu ...)
-	TODO: check
+	NOT-FOR-US: Kofax
 CVE-2024-30369 (A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escala ...)
-	TODO: check
+	NOT-FOR-US: A10 Thunder ADC
 CVE-2024-30368 (A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution ...)
-	TODO: check
+	NOT-FOR-US: A10 Thunder ADC
 CVE-2024-2965 (A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader`  ...)
 	TODO: check
 CVE-2024-2928 (A Local File Inclusion (LFI) vulnerability was identified in mlflow/ml ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba21d61ce4b6d37a9ea1efe7032da9953fd0bf83

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba21d61ce4b6d37a9ea1efe7032da9953fd0bf83
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240607/850a594e/attachment.htm>

More information about the debian-security-tracker-commits mailing list