From 28112fcd8e6c79054bb917d80e5a4e61596927f8 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Sat, 24 Sep 2022 13:31:07 +0200 Subject: Process some NFUs --- data/CVE/list | 152 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 76 insertions(+), 76 deletions(-) (limited to 'data/CVE/list') diff --git a/data/CVE/list b/data/CVE/list index 3e03e90919..66cda86115 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -852,7 +852,7 @@ CVE-2022-40985 CVE-2022-40980 (A potential unathenticated file deletion vulnerabilty on Trend Micro M ...) NOT-FOR-US: Trend Micro CVE-2022-40979 (In JetBrains TeamCity before 2022.04.4 environmental variables of "pas ...) - TODO: check + NOT-FOR-US: JetBrains TeamCity CVE-2022-40978 (The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerabl ...) NOT-FOR-US: installer of JetBrains IntelliJ IDEA CVE-2022-40977 @@ -1760,11 +1760,11 @@ CVE-2022-3193 RESERVED NOT-FOR-US: ovirt-engine CVE-2022-40630 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...) - TODO: check + NOT-FOR-US: Tacitine Firewall CVE-2022-40629 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...) - TODO: check + NOT-FOR-US: Tacitine Firewall CVE-2022-40628 (This vulnerability exists in Tacitine Firewall, all versions of EN6200 ...) - TODO: check + NOT-FOR-US: Tacitine Firewall CVE-2022-40627 RESERVED CVE-2022-40626 (An unauthenticated user can create a link with reflected Javascript co ...) @@ -6284,7 +6284,7 @@ CVE-2022-38744 CVE-2022-38743 RESERVED CVE-2022-38742 (Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is ...) - TODO: check + NOT-FOR-US: Rockwell Automation CVE-2022-38741 RESERVED CVE-2022-38740 @@ -7167,9 +7167,9 @@ CVE-2022-38441 CVE-2022-38440 RESERVED CVE-2022-38439 (Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected b ...) - TODO: check + NOT-FOR-US: Adobe CVE-2022-38438 (Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected b ...) - TODO: check + NOT-FOR-US: Adobe CVE-2022-38437 RESERVED CVE-2022-38436 @@ -8351,7 +8351,7 @@ CVE-2022-38067 (Unauthenticated Event Deletion vulnerability in Totalsoft Event CVE-2022-38062 RESERVED CVE-2022-38061 (Authenticated (author+) CSV Injection vulnerability in Export Post Inf ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-38059 (Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's A ...) NOT-FOR-US: WordPress plugin CVE-2022-38058 (Authenticated (subscriber+) Plugin Setting change vulnerability in WP ...) @@ -8375,23 +8375,23 @@ CVE-2022-37402 CVE-2022-37344 (Missing Access Control vulnerability in PHP Crafts Accommodation Syste ...) NOT-FOR-US: WordPress plugin CVE-2022-37339 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-37338 (Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-37335 (Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerabilit ...) NOT-FOR-US: WordPress plugin CVE-2022-37330 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-37328 (Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerabilit ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-36798 (Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Me ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-36796 (Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cros ...) NOT-FOR-US: WordPress plugin CVE-2022-36793 (Unauthenticated Plugin Settings Change & Data Deletion vulnerabili ...) NOT-FOR-US: WordPress plugin CVE-2022-36791 (Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnera ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-36428 RESERVED CVE-2022-36427 (Missing Access Control vulnerability in About Rentals. Inc. About Rent ...) @@ -12686,7 +12686,7 @@ CVE-2022-36359 (An issue was discovered in the HTTP FileResponse class in Django CVE-2022-36342 RESERVED CVE-2022-36338 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...) - TODO: check + NOT-FOR-US: Insyde CVE-2022-36337 RESERVED CVE-2022-36336 (A link following vulnerability in the scanning function of Trend Micro ...) @@ -13900,7 +13900,7 @@ CVE-2022-35895 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 thro CVE-2022-35894 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...) NOT-FOR-US: Insyde CVE-2022-35893 (An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. ...) - TODO: check + NOT-FOR-US: Insyde CVE-2022-35892 RESERVED CVE-2022-35891 @@ -15603,17 +15603,17 @@ CVE-2022-35252 (When curl is used to retrieve and parse cookies from a HTTP(S) s NOTE: https://www.openwall.com/lists/oss-security/2022/08/31/2 NOTE: https://daniel.haxx.se/blog/2022/09/05/a-bug-that-was-23-years-old-or-not/ CVE-2022-35251 (A cross-site scripting vulnerability exists in Rocket.chat <v5 due ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-35250 (A privilege escalation vulnerability exists in Rocket.chat <v5 whic ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-35249 (A information disclosure vulnerability exists in Rocket.Chat <v5 wh ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-35248 (A improper authentication vulnerability exists in Rocket.Chat <v5, ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-35247 (A information disclosure vulnerability exists in Rocket.chat <v5, & ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-35246 (A NoSQL-Injection information disclosure vulnerability vulnerability e ...) - TODO: check + NOT-FOR-US: Rocket.Chat CVE-2022-34866 (Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box ve ...) NOT-FOR-US: Passage Drive CVE-2022-32765 @@ -21549,7 +21549,7 @@ CVE-2022-2072 (The Name Directory WordPress plugin before 1.25.3 does not saniti CVE-2022-2071 (The Name Directory WordPress plugin before 1.25.4 does not have CSRF c ...) NOT-FOR-US: WordPress plugin CVE-2022-2070 (In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to over ...) - TODO: check + NOT-FOR-US: Grandstream CVE-2022-2069 RESERVED CVE-2022-2068 (In addition to the c_rehash shell command injection identified in CVE- ...) @@ -21924,31 +21924,31 @@ CVE-2022-32855 CVE-2022-32854 (This issue was addressed with improved checks. This issue is fixed in ...) NOT-FOR-US: Apple CVE-2022-32853 (An out-of-bounds read issue was addressed with improved input validati ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32852 (An out-of-bounds read issue was addressed with improved input validati ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32851 (An out-of-bounds read issue was addressed with improved input validati ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32850 RESERVED CVE-2022-32849 (An information disclosure issue was addressed by removing the vulnerab ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32848 (A logic issue was addressed with improved checks. This issue is fixed ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32847 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32846 RESERVED CVE-2022-32845 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32844 RESERVED CVE-2022-32843 (An out-of-bounds write issue was addressed with improved bounds checki ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32842 (An out-of-bounds read issue was addressed with improved input validati ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32841 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32840 (This issue was addressed with improved checks. This issue is fixed in ...) NOT-FOR-US: Apple CVE-2022-32839 (The issue was addressed with improved bounds checks. This issue is fix ...) @@ -21966,46 +21966,46 @@ CVE-2022-32834 (An access issue was addressed with improvements to the sandbox. CVE-2022-32833 RESERVED CVE-2022-32832 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32831 (An out-of-bounds read was addressed with improved bounds checking. Thi ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32830 RESERVED CVE-2022-32829 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32828 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32827 RESERVED CVE-2022-32826 (An authorization issue was addressed with improved state management. T ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32825 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32824 RESERVED CVE-2022-32823 (A memory initialization issue was addressed with improved memory handl ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32822 RESERVED CVE-2022-32821 (A memory corruption issue was addressed with improved validation. This ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32820 (An out-of-bounds write issue was addressed with improved input validat ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32819 (A logic issue was addressed with improved state management. This issue ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32818 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32817 (An out-of-bounds read issue was addressed with improved bounds checkin ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32816 (The issue was addressed with improved UI handling. This issue is fixed ...) {DSA-5211-1 DSA-5210-1 DLA-3073-1} - webkit2gtk 2.36.6-1 - wpewebkit 2.36.6-1 NOTE: https://www.openwall.com/lists/oss-security/2022/07/28/2 CVE-2022-32815 (The issue was addressed with improved memory handling. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32814 (A type confusion issue was addressed with improved state handling. Thi ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32813 (The issue was addressed with improved memory handling. This issue is f ...) NOT-FOR-US: Apple CVE-2022-32812 (The issue was addressed with improved memory handling. This issue is f ...) @@ -22019,11 +22019,11 @@ CVE-2022-32809 CVE-2022-32808 RESERVED CVE-2022-32807 (This issue was addressed with improved file handling. This issue is fi ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32806 RESERVED CVE-2022-32805 (The issue was addressed with improved handling of caches. This issue i ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32804 RESERVED CVE-2022-32803 @@ -22031,17 +22031,17 @@ CVE-2022-32803 CVE-2022-32802 (A logic issue was addressed with improved checks. This issue is fixed ...) NOT-FOR-US: Apple CVE-2022-32801 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32800 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32799 (An out-of-bounds read issue was addressed with improved bounds checkin ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32798 (An out-of-bounds write issue was addressed with improved input validat ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32797 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32796 (A memory corruption issue was addressed with improved state management ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32795 (This issue was addressed with improved checks. This issue is fixed in ...) NOT-FOR-US: Apple CVE-2022-32794 @@ -22057,25 +22057,25 @@ CVE-2022-32792 (An out-of-bounds write issue was addressed with improved input v CVE-2022-32791 RESERVED CVE-2022-32790 (This issue was addressed with improved checks. This issue is fixed in ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32789 (A logic issue was addressed with improved checks. This issue is fixed ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32788 (A buffer overflow was addressed with improved bounds checking. This is ...) NOT-FOR-US: Apple CVE-2022-32787 (An out-of-bounds write issue was addressed with improved bounds checki ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32786 (An issue in the handling of environment variables was addressed with i ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32785 (A null pointer dereference was addressed with improved validation. Thi ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32784 RESERVED CVE-2022-32783 (A logic issue was addressed with improved checks. This issue is fixed ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32782 (This issue was addressed by enabling hardened runtime. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32781 (This issue was addressed by enabling hardened runtime. This issue is f ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-32780 RESERVED CVE-2022-32779 @@ -22626,7 +22626,7 @@ CVE-2022-2027 (Improper Neutralization of Formula Elements in a CSV File in GitH CVE-2022-2026 (Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/ti ...) NOT-FOR-US: kromitgmbh/titra CVE-2022-2025 (an attacker with knowledge of user/pass of Grandstream GSD3710 in its ...) - TODO: check + NOT-FOR-US: Grandstream CVE-2017-20051 (A vulnerability was found in InnoSetup Installer. It has been declared ...) NOT-FOR-US: InnoSetup CVE-2022-32548 (An issue was discovered on certain DrayTek Vigor routers before July 2 ...) @@ -23595,13 +23595,13 @@ CVE-2022-1977 (The Import Export All WordPress Images, Users & Post Types Wo CVE-2022-32230 (Microsoft Windows SMBv3 suffers from a null pointer dereference in ver ...) NOT-FOR-US: Microsoft CVE-2022-32229 (A information disclosure vulnerability exists in Rockert.Chat <v5 d ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32228 (An information disclosure vulnerability exists in Rocket.Chat <v5, ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32227 (A cleartext transmission of sensitive information exists in Rocket.Cha ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32226 (An improper access control vulnerability exists in Rocket.Chat <v5, ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32225 (A reflected DOM-Based XSS vulnerability has been discovered in the Hel ...) NOT-FOR-US: Veeam CVE-2022-32224 @@ -23622,13 +23622,13 @@ CVE-2022-32222 (A cryptographic vulnerability exists on Node.js on linux in vers CVE-2022-32221 RESERVED CVE-2022-32220 (An information disclosure vulnerability exists in Rocket.Chat <v5 d ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32219 (An information disclosure vulnerability exists in Rocket.Chat <v4.7 ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32218 (An information disclosure vulnerability exists in Rocket.Chat <v5, ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32217 (A cleartext storage of sensitive information exists in Rocket.Chat < ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32216 RESERVED CVE-2022-32215 (The llhttp parser in the http module in Node v17.6.0 does not correctl ...) @@ -23660,7 +23660,7 @@ CVE-2022-32212 (A OS Command Injection vulnerability exists in Node.js versions NOTE: https://github.com/nodejs/node/commit/48c5aa5cab718d04473fa2761d532657c84b8131 (v14.x) NOTE: https://github.com/nodejs/node/commit/1aa5036c31ac2a9b2a2528af454675ad412f1464 (main) CVE-2022-32211 (A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v ...) - TODO: check + NOT-FOR-US: Rockert.Chat CVE-2022-32210 (`Undici.ProxyAgent` never verifies the remote server's certificate, an ...) - node-undici 5.6.1+dfsg1+~cs18.9.16-1 NOTE: https://github.com/advisories/GHSA-pgw7-wx7w-2w33 @@ -33625,7 +33625,7 @@ CVE-2022-28888 (Spryker Commerce OS 1.4.2 allows Remote Command Execution. ...) CVE-2022-28887 RESERVED CVE-2022-28886 (A Denial-of-Service vulnerability was discovered in the F-Secure and W ...) - TODO: check + NOT-FOR-US: F-Secure CVE-2022-28885 (A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd ...) NOT-FOR-US: WithSecure CVE-2022-28884 (A Denial-of-Service vulnerability was discovered in the F-Secure and W ...) @@ -36026,7 +36026,7 @@ CVE-2022-1123 (The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) W CVE-2021-46743 (In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., ...) NOT-FOR-US: Firebase PHP-JWT CVE-2020-36521 (An out-of-bounds read was addressed with improved input validation. Th ...) - TODO: check + NOT-FOR-US: Apple CVE-2022-28128 (Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and ear ...) NOT-FOR-US: AttacheCase CVE-2022-27496 (Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and ...) @@ -37665,7 +37665,7 @@ CVE-2022-1039 (The weak password on the web user interface can be exploited via CVE-2022-1038 RESERVED CVE-2022-27492 (An integer underflow in WhatsApp could have caused remote code executi ...) - TODO: check + NOT-FOR-US: WhatsApp CVE-2022-27491 (A improper verification of source of a communication channel in Fortin ...) NOT-FOR-US: FortiGuard CVE-2022-27490 -- cgit v1.2.3