[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 29 08:12:07 GMT 2024
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8398ca3b by security tracker role at 2024-10-29T08:12:01+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,86 +1,290 @@
-CVE-2024-50088 [btrfs: fix uninitialized pointer free in add_inode_ref()]
+CVE-2024-51509 (Tiki through 27.0 allows users who have certain permissions to insert ...)
+ TODO: check
+CVE-2024-51508 (Tiki through 27.0 allows users who have certain permissions to insert ...)
+ TODO: check
+CVE-2024-51507 (Tiki through 27.0 allows users who have certain permissions to insert ...)
+ TODO: check
+CVE-2024-51506 (Tiki through 27.0 allows users who have certain permissions to insert ...)
+ TODO: check
+CVE-2024-50496 (Unrestricted Upload of File with Dangerous Type vulnerability in Web a ...)
+ TODO: check
+CVE-2024-50495 (Unrestricted Upload of File with Dangerous Type vulnerability in Widgi ...)
+ TODO: check
+CVE-2024-50494 (Unrestricted Upload of File with Dangerous Type vulnerability in Amin ...)
+ TODO: check
+CVE-2024-50493 (Unrestricted Upload of File with Dangerous Type vulnerability in maste ...)
+ TODO: check
+CVE-2024-50484 (Unrestricted Upload of File with Dangerous Type vulnerability in mahla ...)
+ TODO: check
+CVE-2024-50482 (Unrestricted Upload of File with Dangerous Type vulnerability in Cheta ...)
+ TODO: check
+CVE-2024-50480 (Unrestricted Upload of File with Dangerous Type vulnerability in azexo ...)
+ TODO: check
+CVE-2024-48594 (File Upload vulnerability in Prison Management System v.1.0 allows a r ...)
+ TODO: check
+CVE-2024-48357 (LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /ad ...)
+ TODO: check
+CVE-2024-48356 (LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.ph ...)
+ TODO: check
+CVE-2024-48178 (newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) ...)
+ TODO: check
+CVE-2024-48177 (MRCMS 3.1.2 contains a SQL injection vulnerability via the RID paramet ...)
+ TODO: check
+CVE-2024-48107 (SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). ...)
+ TODO: check
+CVE-2024-45656 (IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950. ...)
+ TODO: check
+CVE-2024-44302 (The issue was addressed with improved checks. This issue is fixed in t ...)
+ TODO: check
+CVE-2024-44301 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44297 (The issue was addressed with improved bounds checks. This issue is fix ...)
+ TODO: check
+CVE-2024-44296 (The issue was addressed with improved checks. This issue is fixed in t ...)
+ TODO: check
+CVE-2024-44295 (This issue was addressed with additional entitlement checks. This issu ...)
+ TODO: check
+CVE-2024-44294 (A path deletion vulnerability was addressed by preventing vulnerable c ...)
+ TODO: check
+CVE-2024-44289 (A privacy issue was addressed with improved private data redaction for ...)
+ TODO: check
+CVE-2024-44287 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44285 (A use-after-free issue was addressed with improved memory management. ...)
+ TODO: check
+CVE-2024-44284 (An out-of-bounds write issue was addressed with improved input validat ...)
+ TODO: check
+CVE-2024-44283 (An out-of-bounds read was addressed with improved bounds checking. Thi ...)
+ TODO: check
+CVE-2024-44282 (An out-of-bounds read was addressed with improved input validation. Th ...)
+ TODO: check
+CVE-2024-44281 (An out-of-bounds read was addressed with improved input validation. Th ...)
+ TODO: check
+CVE-2024-44280 (A downgrade issue affecting Intel-based Mac computers was addressed wi ...)
+ TODO: check
+CVE-2024-44279 (An out-of-bounds read was addressed with improved input validation. Th ...)
+ TODO: check
+CVE-2024-44278 (An information disclosure issue was addressed with improved private da ...)
+ TODO: check
+CVE-2024-44277 (The issue was addressed with improved memory handling. This issue is f ...)
+ TODO: check
+CVE-2024-44275 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44274 (The issue was addressed with improved authentication. This issue is fi ...)
+ TODO: check
+CVE-2024-44273 (This issue was addressed with improved handling of symlinks. This issu ...)
+ TODO: check
+CVE-2024-44270 (A logic issue was addressed with improved validation. This issue is fi ...)
+ TODO: check
+CVE-2024-44269 (A logic issue was addressed with improved checks. This issue is fixed ...)
+ TODO: check
+CVE-2024-44267 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44265 (The issue was addressed by restricting options offered on a locked dev ...)
+ TODO: check
+CVE-2024-44264 (This issue was addressed with improved validation of symlinks. This is ...)
+ TODO: check
+CVE-2024-44263 (A logic issue was addressed with improved state management. This issue ...)
+ TODO: check
+CVE-2024-44262 (This issue was addressed with improved redaction of sensitive informat ...)
+ TODO: check
+CVE-2024-44261 (This issue was addressed by restricting options offered on a locked de ...)
+ TODO: check
+CVE-2024-44260 (This issue was addressed by removing the vulnerable code. This issue i ...)
+ TODO: check
+CVE-2024-44259 (This issue was addressed through improved state management. This issue ...)
+ TODO: check
+CVE-2024-44258 (This issue was addressed with improved handling of symlinks. This issu ...)
+ TODO: check
+CVE-2024-44257 (This issue was addressed with improved redaction of sensitive informat ...)
+ TODO: check
+CVE-2024-44256 (The issue was addressed with improved input sanitization. This issue i ...)
+ TODO: check
+CVE-2024-44255 (A path handling issue was addressed with improved logic. This issue is ...)
+ TODO: check
+CVE-2024-44254 (This issue was addressed with improved redaction of sensitive informat ...)
+ TODO: check
+CVE-2024-44253 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44252 (A logic issue was addressed with improved file handling. This issue is ...)
+ TODO: check
+CVE-2024-44251 (This issue was addressed through improved state management. This issue ...)
+ TODO: check
+CVE-2024-44247 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44244 (A memory corruption issue was addressed with improved input validation ...)
+ TODO: check
+CVE-2024-44240 (The issue was addressed with improved checks. This issue is fixed in t ...)
+ TODO: check
+CVE-2024-44239 (An information disclosure issue was addressed with improved private da ...)
+ TODO: check
+CVE-2024-44237 (An out-of-bounds access issue was addressed with improved bounds check ...)
+ TODO: check
+CVE-2024-44236 (An out-of-bounds access issue was addressed with improved bounds check ...)
+ TODO: check
+CVE-2024-44235 (The issue was addressed with improved checks. This issue is fixed in i ...)
+ TODO: check
+CVE-2024-44229 (An information leakage was addressed with additional validation. This ...)
+ TODO: check
+CVE-2024-44228 (This issue was addressed with improved permissions checking. This issu ...)
+ TODO: check
+CVE-2024-44222 (This issue was addressed with improved redaction of sensitive informat ...)
+ TODO: check
+CVE-2024-44218 (This issue was addressed with improved checks. This issue is fixed in ...)
+ TODO: check
+CVE-2024-44217 (A permissions issue was addressed by removing vulnerable code and addi ...)
+ TODO: check
+CVE-2024-44216 (An access issue was addressed with additional sandbox restrictions. Th ...)
+ TODO: check
+CVE-2024-44215 (This issue was addressed with improved checks. This issue is fixed in ...)
+ TODO: check
+CVE-2024-44213 (An issue existed in the parsing of URLs. This issue was addressed with ...)
+ TODO: check
+CVE-2024-44208 (This issue was addressed through improved state management. This issue ...)
+ TODO: check
+CVE-2024-44203 (A permissions issue was addressed with additional restrictions. This i ...)
+ TODO: check
+CVE-2024-44197 (The issue was addressed with improved memory handling. This issue is f ...)
+ TODO: check
+CVE-2024-44196 (A permissions issue was addressed with additional restrictions. This i ...)
+ TODO: check
+CVE-2024-44194 (This issue was addressed with improved redaction of sensitive informat ...)
+ TODO: check
+CVE-2024-44175 (This issue was addressed with improved validation of symlinks. This is ...)
+ TODO: check
+CVE-2024-44174 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44159 (A path deletion vulnerability was addressed by preventing vulnerable c ...)
+ TODO: check
+CVE-2024-44156 (A path deletion vulnerability was addressed by preventing vulnerable c ...)
+ TODO: check
+CVE-2024-44155 (A custom URL scheme handling issue was addressed with improved input v ...)
+ TODO: check
+CVE-2024-44145 (This issue was addressed through improved state management. This issue ...)
+ TODO: check
+CVE-2024-44144 (A buffer overflow was addressed with improved size validation. This is ...)
+ TODO: check
+CVE-2024-44137 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44126 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-44123 (A permissions issue was addressed with additional restrictions. This i ...)
+ TODO: check
+CVE-2024-44122 (A logic issue was addressed with improved checks. This issue is fixed ...)
+ TODO: check
+CVE-2024-42011 (The Spotify app 8.9.58 for iOS has a buffer overflow in its use of str ...)
+ TODO: check
+CVE-2024-40867 (A custom URL scheme handling issue was addressed with improved input v ...)
+ TODO: check
+CVE-2024-40855 (The issue was addressed with improved checks. This issue is fixed in m ...)
+ TODO: check
+CVE-2024-40853 (This issue was addressed by restricting options offered on a locked de ...)
+ TODO: check
+CVE-2024-40851 (This issue was addressed by restricting options offered on a locked de ...)
+ TODO: check
+CVE-2024-40792 (A permissions issue was addressed with additional restrictions. This i ...)
+ TODO: check
+CVE-2024-30106 (HCL Connections is vulnerable to an information disclosure vulnerabili ...)
+ TODO: check
+CVE-2024-27849 (A privacy issue was addressed with improved private data redaction for ...)
+ TODO: check
+CVE-2024-22065 (There is a command injection vulnerability in ZTE MF258 Pro product. D ...)
+ TODO: check
+CVE-2024-10479 (A vulnerability, which was classified as problematic, was found in Lin ...)
+ TODO: check
+CVE-2024-10478 (A vulnerability, which was classified as problematic, has been found i ...)
+ TODO: check
+CVE-2024-10477 (A vulnerability classified as problematic was found in LinZhaoguan pb- ...)
+ TODO: check
+CVE-2024-10312 (The Exclusive Addons for Elementor plugin for WordPress is vulnerable ...)
+ TODO: check
+CVE-2024-10008 (The Masteriyo LMS \u2013 eLearning and Online Course Builder for WordP ...)
+ TODO: check
+CVE-2024-10000 (The Masteriyo LMS \u2013 eLearning and Online Course Builder for WordP ...)
+ TODO: check
+CVE-2024-50088 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4 (6.12-rc4)
-CVE-2024-50087 [btrfs: fix uninitialized pointer free on read_alloc_one_name() error]
+CVE-2024-50087 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/2ab5e243c2266c841e0f6904fad1514b18eaf510 (6.12-rc4)
-CVE-2024-50086 [ksmbd: fix user-after-free from session log off]
+CVE-2024-50086 (In the Linux kernel, the following vulnerability has been resolved: k ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/7aa8804c0b67b3cb263a472d17f2cb50d7f1a930 (6.12-rc4)
-CVE-2024-50085 [mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow]
+CVE-2024-50085 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/7decd1f5904a489d3ccdcf131972f94645681689 (6.12-rc4)
-CVE-2024-50084 [net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()]
+CVE-2024-50084 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/217a3d98d1e9891a8b1438a27dfbc64ddf01f691 (6.12-rc4)
-CVE-2024-50083 [tcp: fix mptcp DSS corruption due to large pmtu xmit]
+CVE-2024-50083 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/4dabcdf581217e60690467a37c956a5b8dbc6bd9 (6.12-rc3)
-CVE-2024-50082 [blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race]
+CVE-2024-50082 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/e972b08b91ef48488bae9789f03cfedb148667fb (6.12-rc4)
-CVE-2024-50081 [blk-mq: setup queue ->tag_set before initializing hctx]
+CVE-2024-50081 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c25c0c9035bb8b28c844dfddeda7b8bdbcfcae95 (6.12-rc4)
-CVE-2024-50080 [ublk: don't allow user copy for unprivileged device]
+CVE-2024-50080 (In the Linux kernel, the following vulnerability has been resolved: u ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/42aafd8b48adac1c3b20fe5892b1b91b80c1a1e6 (6.12-rc4)
-CVE-2024-50079 [io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work]
+CVE-2024-50079 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b (6.12-rc4)
-CVE-2024-50078 [Bluetooth: Call iso_exit() on module unload]
+CVE-2024-50078 (In the Linux kernel, the following vulnerability has been resolved: B ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/d458cd1221e9e56da3b2cc5518ad3225caa91f20 (6.12-rc4)
-CVE-2024-50077 [Bluetooth: ISO: Fix multiple init when debugfs is disabled]
+CVE-2024-50077 (In the Linux kernel, the following vulnerability has been resolved: B ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/a9b7b535ba192c6b77e6c15a4c82d853163eab8c (6.12-rc4)
-CVE-2024-50076 [vt: prevent kernel-infoleak in con_font_get()]
+CVE-2024-50076 (In the Linux kernel, the following vulnerability has been resolved: v ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/f956052e00de211b5c9ebaa1958366c23f82ee9e (6.12-rc4)
-CVE-2024-50075 [xhci: tegra: fix checked USB2 port number]
+CVE-2024-50075 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/7d381137cb6ecf558ef6698c7730ddd482d4c8f2 (6.12-rc4)
-CVE-2024-50074 [parport: Proper fix for array out-of-bounds access]
+CVE-2024-50074 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9 (6.12-rc4)
-CVE-2024-50073 [tty: n_gsm: Fix use-after-free in gsm_cleanup_mux]
+CVE-2024-50073 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/9462f4ca56e7d2430fdb6dcc8498244acbfc4489 (6.12-rc4)
-CVE-2024-50072 [x86/bugs: Use code segment selector for VERW operand]
+CVE-2024-50072 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 6.11.5-1
NOTE: https://git.kernel.org/linus/e4d2102018542e3ae5e297bc6e229303abff8a0f (6.12-rc4)
-CVE-2024-50071 [pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()]
+CVE-2024-50071 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/3fd976afe9743110f20a23f93b7ff9693f2be4bf (6.12-rc4)
-CVE-2024-50070 [pinctrl: stm32: check devm_kasprintf() returned value]
+CVE-2024-50070 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/b0f0e3f0552a566def55c844b0d44250c58e4df6 (6.12-rc4)
-CVE-2024-50069 [pinctrl: apple: check devm_kasprintf() returned value]
+CVE-2024-50069 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.11.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/665a58fe663ac7a9ea618dc0b29881649324b116 (6.12-rc4)
-CVE-2024-50068 [mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets()]
+CVE-2024-50068 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.11.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
@@ -22931,7 +23135,7 @@ CVE-2024-33519 (A vulnerability in the web-based management interface of HPE Aru
NOT-FOR-US: HPE Aruba Networking EdgeConnect SD-WAN gateway
CVE-2024-31977 (Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version ...)
NOT-FOR-US: Adtran 834-5
-CVE-2024-31971 (**UNSUPPORTED WHEN ASSIGNED** Multiple stored cross-site scripting (XS ...)
+CVE-2024-31971 (Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran N ...)
NOT-FOR-US: AdTran NetVanta 3120 devices
CVE-2024-31970 (AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixe ...)
NOT-FOR-US: Adtran 834-5 devices
@@ -24366,7 +24570,7 @@ CVE-2024-40516 (An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC300
NOT-FOR-US: H3C Magic RC3000 RC3000V100R009
CVE-2024-40515 (An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.4 ...)
NOT-FOR-US: Tenda
-CVE-2024-40505 (**UNSUPPORTED WHEN ASSIGNED** Directory Traversal vulnerability in D-L ...)
+CVE-2024-40505 (Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 a ...)
NOT-FOR-US: D-Link
CVE-2024-40503 (An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to c ...)
NOT-FOR-US: Tenda
@@ -35079,7 +35283,8 @@ CVE-2024-37160 (Formwork is a flat file-based Content Management System (CMS). A
NOT-FOR-US: Formwork CMS
CVE-2024-36827 (An XML External Entity (XXE) vulnerability in the ebookmeta.get_metada ...)
NOT-FOR-US: ebookmeta
-CVE-2024-36811 (An arbitrary file upload vulnerability in the image upload function of ...)
+CVE-2024-36811
+ REJECTED
NOT-FOR-US: Aimeos
CVE-2024-36792 (An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/ ...)
NOT-FOR-US: Netgear
@@ -61587,7 +61792,7 @@ CVE-2024-28131 (EasyRange Ver 1.41 contains an issue with the executable file se
NOT-FOR-US: EasyRange
CVE-2024-28126 (Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. ...)
NOT-FOR-US: 0ch BBS Script
-CVE-2024-28093 (**UNSUPPORTED WHEN ASSIGNED** The TELNET service of AdTran NetVanta 31 ...)
+CVE-2024-28093 (The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is en ...)
NOT-FOR-US: AdTran NetVanta devices
CVE-2024-28048 (OS command injection vulnerability exists in ffBull ver.4.11, which ma ...)
NOT-FOR-US: ffBull
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8398ca3b29516429e44a2c9a4c7c654c91e33d8e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8398ca3b29516429e44a2c9a4c7c654c91e33d8e
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241029/5ed1ed76/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list