security/vuxml 1.1_6

security/vuxml: add www/*chromium < 114.0.5735.106

Approved by:	rene (mentor, implicit)
Obtained from:	https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: update qpress package infromation with xtrabackup8

- According to https://jira.percona.com/browse/PXB-2854 xtrabackup
  2.xx is not impacted

security/vuxml: Add qpress vulnerability CVE-2022-45866

security/vuxml: Add www/kanboard CVEs

* CVE-2023-33956: with Base Score 4.3 (MEDIUM)
 * CVE-2023-33968: with Base Score 5.4 (MEDIUM)
 * CVE-2023-33969: with Base Score 6.4 (MEDIUM)
 * CVE-2023-33970: with Base Score 5.4 (MEDIUM)

security/vuxml: Fix entry fd87a250-ff78-11ed-8290-a8a1599412c6

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add OpenSSL vulnerability CVE-2023-2650

security/vuxml: Add XSS php80-kanboard vulnerability

CVE-2023-32685 with Base Score 7.1 (HIGH)

PR:	271702

security/vuxml: add www/*chromium < 114.0.5735.90

Approved by:	rene (mentor, implicit)
Obtained from:	https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html

security/vuxml: Document MariaDB vulnerability

security/vuxml: add phpmyfaq < 3.1.14

security/vuxml: Add curl 8.1.0 CVEs

Sponsored by:	<Rubicon Communications, LLC ("Netgate")

security/vuxml: Mark zeek < 5.0.9 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v5.0.9

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted series of FTP packets with a CMD command
   with a large path followed by a very large number of replies
   could cause Zeek to spend a long time processing the data.

 - A specially-crafted with a truncated header can cause Zeek to
   overflow memory and potentially crash.

 - A specially-crafted series of SMTP packets can cause Zeek to
   generate a very large number of events and take a long time to
   process them.

 - A specially-crafted series of POP3 packets containing MIME data
   can cause Zeek to spend a long time dealing with each individual
   file ID.

Reported by:	Tim Wojtulewicz

security/vuxml: document electron vulnerability

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.10,
		https://github.com/electron/electron/releases/tag/v23.3.3

security/vuxml: add www/*chromium < 113.0.5672.126

Approved by:	rene (mentor, implicit)
Obtained from:	https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_16.html

security/vuxml: Remove empty cvename entry

This should fix the FreeBSD VuXML website build.

security/vuxml: add missing xmlns to body tag of

2023's vuln entry 8e20430d-a72b-11ed-a04f-40b034455553
(MinIO admin user creation from unprivileged account, CVE-2022-24842)

This fixes vxquery complaints (the line number might differ
depending on how many entries we've added to vuln/2023.xml):

Parsing failed @ line 4675:
Expected element in XHTML namespace.

security/vuxml: document gitlab-ce vulnerability

security/vuxml: add piwigo vulnerabilities

security/vuxml: document postgresql-server vulnerabilities

CVE-2023-2454
CVE-2023-2455

security/vuxml: document vscode information disclosure vulnerability

Obtained from:	https://github.com/microsoft/vscode/security/advisories/GHSA-mmfh-4pv3-39hr

security/vuxml: Multiple glpi vulnerabilities

CVE-2023-28849
CVE-2023-28632
CVE-2023-28838
CVE-2023-28852
CVE-2023-28636
CVE-2023-28639
CVE-2023-28634
CVE-2023-28633

PR:		271286
Reported by:	mathias@monnerville.com

security/vuxml: Document crash on access vulnerability in redis

security/vuxml: document gitlab vulnerability

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: add www/*chromium < 113.0.5672.63

Approved by:	rene (mentor, implicit)
Obtained from:	https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html

security/vuxml: document gitlab-ce vulnerabilities

security/vuxml: Add net/cloud-init* CVE

CVE-2023-1786: Sensitive data leak.

security/vuxml: add h2o CVE-2023-30847 entry

Security:       4da51989-5a8b-4eb9-b442-46d94ec0802d
    Security:       CVE-2023-30847

security/vuxml: Update ghostscript CVE-2023-28879 entry

and mark ghostscript9-agpl-base 9.56.1_10 as fixed,
and remove ghostscript9-agpl-x11 which does not seem to be
using the vulnerable code.

Security:	25872b25-da2d-11ed-b715-a1e76793953b
Security:	CVE-2023-28879
PR:		270823

security/vuxml: Document grafana{8,9} security vulnerabilities

* CVE-2023-1387
* CVE-2023-24538

PR:		271086
Reported by:	Boris Korzun

security/vuxml: Document devel/git vulnerabilities

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Document vulnerability in www/element-web

security/vuxml: jellyfin multiple vulnerabilities

CVE-2023-30626 - directory traversal vulnerability
CVE-2023-30627 - XSS vulnerability

PR:		271041
Reported by:	debdrup@

security/vuxml: add phpmyfaq < 3.1.13

security/vuxml: fix typo in ghostscript entry update

security/vuxml: fix up ghostscript version range of CVE-2023-28879

Pointy hat to:	mandree@ for misreading the quoted Artifex page
Reported by:	Nicholas Taylor <nicholas.e.taylor@gmail.com>
PR:		270823 (comment #3)
Security:	CVE-2023-28879
Security:	25872b25-da2d-11ed-b715-a1e76793953b

security/vuxml: Fix URLs in MySQL 2023Q2 vulnerabilities

security/vuxml: Document MySQL 2023Q2 vulnerabilities

security/vuxml: add www/*chromium < 112.0.5615.165

Approved by:	rene (mentor)
Obtained from:	https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html
Differential Revision:	https://reviews.freebsd.org/D39717

security/vuxml: add libxml2 < 2.10.4

security/vuxml: add mod_gnutls <= 0.12.1

security/vuxml: add www/*chromium < 112.0.5615.121

Approved by:	rene (mentor)
Obtained from:	https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html
Differential Revision:	https://reviews.freebsd.org/D39578

security/vuxml: fix vuxml build

Remove invalid CVE entries introduced in d58bc805721a.

Pointy hat to:	wen

security/vuxml: revise ghostscript vuln entry.

security/vuxml: ghostscript < 10.01.1 buffer overflow

Security:	25872b25-da2d-11ed-b715-a1e76793953b
Security:	CVE-2023-28879

security/vuxml: Mark zeek < 5.0.8 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v5.0.8

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted stream of FTP packets containing a command
   reply with many intermediate lines can cause Zeek to spend a
   large amount of time processing data.

 - A specially-crafted set of packets containing extremely large
   file offsets cause cause the reassembler code to allocate large
   amounts of memory.

 - The DNS manager does not correctly expire responses that don't
   contain any data, such those containing NXDOMAIN or NODATA status
   codes. This can lead to Zeek allocating large amounts of memory
   for these responses and never deallocating them.

 - A specially-crafted stream of RDP packets can cause Zeek to spend
   large protocol validation.

 - A specially-crafted stream of SMTP packets can cause Zeek to
   spend large amounts of time processing data.

Reported by:	Tim Wojtulewicz

security/vuxml: add another batch of pysec vulnerabilities

Vulnerable Python ports discovered with pysec2vuxml.
See also: <https://github.com/HubTou/pysec2vuxml>.

PR:	270744

security/vuxml: mark ffmpeg >= 4.4.4,1 as not vulnerable

security/vuxml: Document vulnerability in traefik before 2.9.9_1