security/vuxml 1.1_6

security/vuxml: mark xorg-server < 21.1.5,1 as vulnerable

security/vuxml: document gitlab-ce vulnerabilities

security/vuxml: add www/*chromium < 109.0.5414.74

Obtained from:	https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html

security/vuxml: Fix `make validate`

PR:		268837

security/vuxml: Add 2023 to the main XML file

PR:		268837

security/vuxml: Add net-mgmt/cacti vulnerability

A command injection vulnerability allows an unauthenticated user to execute
arbitrary code on a server running Cacti, if a specific data source was selected
for any monitored device.

PR:	268742

security/vuxml: amend entry adding CVE-2023-22456 in devel/viewvc-devel

PR:		268754
Security:	CVE-2023-22456

security/vuxml: add an entry for CVE-2023-22464 in devel/viewvc-devel

Security:	CVE-2023-22464

security/vuxml: add an entry for CVE-2022-4170 in x11/rxvt-unicode

Security:	CVE-2022-4170

security/vuxml: Document Gitea multiple vulnerabilities

PR:		268667

security/vuxml: Remove the uncorrect <cvsname> line in my previous commit

security/vuxml: Document Webtrees vulnerability

PR:		267466

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: Document Netdata multiple vulnerabilities

security/vuxml: Document FreeRDP multiple vulnerabilities

PR:		268539

security/vuxml: Document Gitea multiple vulnerabilities

PR:		268512

VuXML: fix typo in 2021 entry for accountsservice

Fixes:                 d227a2fea96e Document accountsservice vulnerability
Approved by:           ports-secteam (riggs)
Differential revision: https://reviews.freebsd.org/D37721

security/vuxml: Document typo3 multiple vulnerabilities

security/vuxml: add www/*chromium < 108.0.5359.124

Obtained from:	https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html

security/vuxml: Document multiple vulnerabilities in cURL.

security/vuxml: Document vulnerabilities in phpmyfaq

security/vuxml: Document vulnerabilities in net/traefik

security/vuxml: Make `make validate` pass again

security/vuxml: Document multiple xrdp vulnerabilities

Obrained from:	https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.21

security/vuxml: Document python3[7-9] multiple vulnerabilities

security/vuxml: Document python310 multiple vulnerabilities

security/vuxml: Document python-3.11 vulnerabilities

security/vuxml: Document Go vulnerabilities

security/vuxml: Adjust range of 84ab03b6-6c20-11ed-b519-080027f5fec9

Vulnerability of Ruby 3.2 is fixed with 3.2.0-rc1.

security/vuxml: add www/*chromium < 108.0.5359.94

Obtained from:	https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html

security/vuxml: Record rpm4 vulnerability.

Add multiple CVE fixed in latest rpm4 version.
PR:		267291

security/vuxml: Record grafana9 vulnerability.

Add privilege escalation for CVE-2022-31097.
PR:	268078

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/chromium < 108.0.5359.71

Obtained from:	https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html

security/vuxml: add www/chromium < 107.0.5304.121

Obtained from:	https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html

security/vuxml: Document HTTP response splitting vulnerability in rubygem-cgi

security/vuxml: Mark zeek < 5.0.4 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v5.0.4

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted series of HTTP 0.9 packets can cause Zeek
   to spend large amounts of time processing the packets.

 - A specially-crafted FTP packet can cause Zeek to spend large
   amounts of time processing the command.

 - A specially-crafted IPv6 packet can cause Zeek to overflow memory
   and potentially crash.

Reported by:	Tim Wojtulewicz

security/vuxml: Add multiple CVEs for advancecomp

PR:	267937

security/vuxml: Document vulnerability for security/tailscale

security/vuxml: Document Apache Tomcat vulnerability

* CVE-2022-42252 Apache Tomcat - Request Smuggling

PR:		266984

security/vuxml: Add the krb5 1.19 vulnerable range

security/vuxml: re-organize port

- move vuln-YYYY.xml files into vuln/ as just YYYY.xml
- this prevents problems with the new check_files hook when 2023 arrives.

security/vuxml: Document CVE-2022-42898

Document MIT krb5 Security Advisory 2022-001: integer overflow
vulnerabilities in PAC parsing

security/vuxml: Document Grafana multiple vulnerabilities

* CVE-2022-31123 - Plugin signature bypass
* CVE-2022-31130 - Data source and plugin proxy endpoints leaking
  authentication tokens to some destination plugins
* CVE-2022-39201 - Data source and plugin proxy endpoints leaking
  authentication tokens to some destination plugins
* CVE-2022-39229 - Improper authentication
* CVE-2022-39306 - Privilege escalation
* CVE-2022-39307 - Username enumeration
* CVE-2022-39328 - Privilege escalation (Critical)

https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/
https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/

PR:		267728

security/vuxml: Add devel/ipython issue

PR:		265082

security/vuxml: Document phpMyFAQ vulnerabilities

security/vuxml: Add varnish cache security issues

security/vuxml: add www/chromium < 107.0.5304.110

Obtained from:	https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html

security/vuxml: Mark zeek < 5.0.3 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v5.0.3

This release fixes the following potential DoS vulnerabilities:

 - Fix an issue where a specially-crafted FTP packet can cause Zeek
   to spend large amounts of time attempting to search for valid
   commands in the data stream.

 - Fix a possible overflow in the Zeek dictionary code that may
   lead to a memory leak.

 - Fix an issue where a specially-crafted packet can cause Zeek to
   spend large amounts of time reporting analyzer violations.

 - Fix a possible assert and crash in the HTTP analyzer when receiving
   a specially-crafted packet.

 - Fix an issue where a specially-crafted HTTP or SMTP packet can
   cause Zeek to spend a large amount of time attempting to search
   for filenames within the packet data.

 - Fix two separate possible crashes when converting processed IP
   headers for logging via the raw_packet event handlers.

This release fixes the following bugs:

 - Fix a possible crash with when statements where lambda captures
   of local variables sometimes overflowed the frame counter.

 - Reduced the amount of analyzer_confirmation events that are
   raised for packets that contain tunnels.

 - Fix a long-standing bug where TCP reassembly would not function
   correctly for some analyzers if dpd_reassemble_first_packets was
   set to false.

 - Fix a performance bug in the Zeek dictionary code in certain
   cases, such as copying a large number of entries from one
   dictionary into another.

 - Fix a performance issue when inserting large numbers of elements
   into a Broker store when Broker::scheduler_policy is set to
   stealing.

 - Fix a Broker performance issue when distributing large amounts
   of data from the input framework to proxies/workers at startup.

 - Fix an issue with messaging between proxies and workers that
   resulted in error messages being reported.

 - Updated the list of DNS type strings to reflect the correct.

Reported by:	Tim Wojtulewicz

security/vuxml: register darkhttpd DoS vulnerability

PR:		267507
Reported by:	Henrich Hartzer <henrichhartzer@tuta.io>
Security:	CVE-2020-25691