[Git][security-tracker-team/security-tracker][master] bugnums

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
55e3a44b by Moritz Mühlenhoff at 2024-10-18T19:13:24+02:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -61,7 +61,7 @@ CVE-2024-38820 (The fix for CVE-2022-22968 made disallowedFieldspatterns in Data
 CVE-2024-33453 (Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacke ...)
 	NOT-FOR-US: esp-idf
 CVE-2024-30875 (Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1 ...)
-	- jqueryui <unfixed>
+	- jqueryui <unfixed> (bug #1085379)
 	NOTE: https://github.com/Ant1sec-ops/CVE-2024-30875
 CVE-2024-27766 (An issue in MYSQL MariaDB v.11.1 allows a remote attacker to execute a ...)
 	NOTE: Dubious mysql/mariadb issue, reached out to upstream
@@ -378,15 +378,15 @@ CVE-2024-48758 (dingfanzu CMS V1.0 was discovered to contain a Cross-Site Reques
 CVE-2024-48180 (ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method i ...)
 	NOT-FOR-US: ClassCMS
 CVE-2024-47889 (Action Mailer is a framework for designing email service layers. Start ...)
-	- rails <unfixed>
+	- rails <unfixed> (bug #1085376)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
 	NOTE: https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9
 CVE-2024-47888 (Action Text brings rich text content and editing to Rails. Starting in ...)
-	- rails <unfixed>
+	- rails <unfixed> (bug #1085376)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
 	NOTE: https://github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468
 CVE-2024-47887 (Action Pack is a framework for handling and responding to web requests ...)
-	- rails <unfixed>
+	- rails <unfixed> (bug #1085376)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
 	NOTE: https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
 CVE-2024-46213 (REDAXO CMS v2.11.0 was discovered to contain a remote code execution ( ...)
@@ -414,7 +414,7 @@ CVE-2024-9444 (The ElementsReady Addons for Elementor plugin for WordPress is vu
 CVE-2024-9348 (Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source ...)
 	NOT-FOR-US: Docker Desktop
 CVE-2024-9143 (Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with u ...)
-	- openssl <unfixed>
+	- openssl <unfixed> (bug #1085378)
 	[bookworm] - openssl <postponed> (Minor issue, fix along in next update)
 	NOTE: https://openssl-library.org/news/secadv/20241016.txt
 	NOTE: https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712
@@ -529,7 +529,7 @@ CVE-2024-45072 (IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an
 CVE-2024-45071 (IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored c ...)
 	NOT-FOR-US: IBM
 CVE-2024-41128 (Action Pack is a framework for handling and responding to web requests ...)
-	- rails <unfixed>
+	- rails <unfixed> (bug #1085376)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
 	NOTE: https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
 CVE-2024-38814 (An authenticated SQL injection vulnerability in VMware HCX was private ...)
@@ -945,7 +945,7 @@ CVE-2024-45272 (An unauthenticated remote attacker can perform a brute-force att
 CVE-2024-45271 (An unauthenticated local attacker can gain admin privileges by deployi ...)
 	NOT-FOR-US: MB connect line GmbH
 CVE-2024-44337 (The package `github.com/gomarkdown/markdown` is a Go library for parsi ...)
-	- golang-github-gomarkdown-markdown <unfixed>
+	- golang-github-gomarkdown-markdown <unfixed> (bug #1085377)
 	NOTE: https://github.com/Brinmon/CVE-2024-44337
 	NOTE: https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252
 CVE-2024-41344 (A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attac ...)
@@ -1199,7 +1199,7 @@ CVE-2024-35518 (Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in g
 CVE-2024-30117 (A dynamic search for a prerequisite library could allow the possibilit ...)
 	NOT-FOR-US: HCL
 CVE-2024-21535 (Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to ...)
-	- node-markdown-to-jsx <unfixed>
+	- node-markdown-to-jsx <unfixed> (bug #1085375)
 	NOTE: https://security.snyk.io/vuln/SNYK-JS-MARKDOWNTOJSX-6258886
 	NOTE: https://github.com/quantizor/markdown-to-jsx/commit/8eb74da825c0d8d2e9508d73c672bcae36ba555a (v7.4.0)
 CVE-2024-0129 (NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a u ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55e3a44b91b641705fbcec231fc2f13d40f2cacf

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55e3a44b91b641705fbcec231fc2f13d40f2cacf
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241018/a6745092/attachment.htm>