security/vuxml: mark libXpm < 3.5.15 as vulnerable

security/vuxml: Remove empty cvename tag in jenkins entry

security/vuxml: Document vulnerability for security/tailscale

PR:		270406

security/vuxml: add www/*chromium < 111.0.5563.110

Approved by:	rene (mentor)
Obtained
from:	https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html

security/vuxml: Document denial-of-serviece vulnerability in redis

security/vuxml: Document multiple vulnerabilities in curl

security/vuxml: Document phpmyadmin vulnerabilities

security/vuxml: Autofill CVE information

The `newentry` target accepts an optional parameter CVE_ID.
When provided, the newentry.sh script tries to retrieve information from the
NVD and MITRE databases and fill the template accordingly.

The script needs `textproc/jq` and warns the user and exists if it is not found.

How to use it:

make newentry CVE_ID=CVE-2022-39282

Note that this is just a helper. *YOU HUMAN* have to check that the information
is correct.

Reviewed by: tcberner, jlduran_gmail.com, mat
Differential Revision: https://reviews.freebsd.org/D38894

security/vuxml: Document Apache httpd vulnerabilities

Sponsored by:	Netzkommune GmbH

security/vuxml: fix typo in the openoffice entry

Fix a typo in the openoffice devel version value in the latest
openoffice entry.

security/vuxml: add www/*chromium < 111.0.5563.64

Approved by:	rene (mentor)
Obtained
from:	https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html
Differential Revision:	https://reviews.freebsd.org/D38992

security/vuxml: Document Jenkins Security Advisory 2023-03-08

Sponsored by:	The FreeBSD Foundation

security/vuxml: databases/mantis <2.25.6 CVEs

CVE-2023-22476 and CVE-2022-31129

ChangeLog:
https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&amp;version=2.25.6

PR:		270039
Reported by:	zab@zltech.eu

security/vuxml: Document Go vulnerability

security/vuxml: openoffice 2022 vulnerabilities

Belatedly document Apache OpenOffice vulnerabilities from 2022.  The
port was broken at the time.

security/vuxml: Document possible DoS vulnerability in rack

security/vuxml: Document multiple vulnerabilities in curl

security/vuxml: document strongSwan certificate verification vulnerability

Security:	3f9b6943-ba58-11ed-bbbd-00e0670f2660

security/vuxml: Document gitlab-ce vulnerabilities

security/vuxml: document grafana{8,9} CVEs

 * CVE-2023-0507 - Stored XSS in geomap panel plugin via attribution (High)
 * CVE-2023-0594 - Stored XSS in TraceView panel (High)
 * CVE-2023-22462 - Stored XSS in text panel plugin

PR:		269903
Reported by:	drtr0jan@yandex.ru

security/vuxml: Document multiple vulnerabilities in redis

security/vuxml: Document multiple vulnerabilities in Emacs

security/vuxml: correct "vulnerabilities" spelling

Closes:	https://github.com/freebsd/freebsd-ports/pull/164

security/vuxml: document vulnerabilities for net/freerdp

CVE-2022-39282 and CVE-2022-39283.

PR:		269667
Reported by:	grahamperrin@freebsd.org

security/vuxml: add www/*chromium < 110.0.5481.177

Approved by:	rene (mentor)
Obtained
from:	https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html

security/vuxml: Mark zeek < 5.0.7 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v5.0.7

This release fixes the following potential DoS vulnerabilities:

 - Receiving DNS responses from async DNS requests (via the
   lookup_addr, etc BIF methods) with the TTL set to zero could
   cause the DNS manager to eventually stop being able to make new
   requests.

 - Specially-crafted FTP packets with excessively long usernames,
   passwords, or other fields could cause log writes to use large
   amounts of disk space.

 - The find_all and find_all_ordered BIF methods could take extremely
   large amounts of time to process incoming data depending on the
   size of the input.

Reported by:	Tim Wojtulewicz

security/vuxml: Document libde265 vulnabilities.

PR:             269382
Reported by:    diizzy@

security/vuxml: Document recent git CVEs

Document CVEs fixed by devel/git 2.39.1 and 2.39.2:

CVE-2022-41903
CVE-2022-23521
CVE-2023-22490
CVE-2023-23946
PR:		269655
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Add gitea vulnerabilities

PR:		269707

security/vuxml: Document vulnerable x/net/http2 module in traefik

security/vuxml: document log4j vulnerability in sysutils/rundeck3

PR:		261748
Reported by:	ruben@verweg.com
Approved by:	flo (mentor)
Differential Revision: https://reviews.freebsd.org/D38636

security/vuxml: Add www/minio vulnerability

CVE-2022-24842: unprivileged users can create service accounts for admin users.

PR:		268656
Reported by:	adam@omega.org.uk
Obtained from:	https://github.com/freebsd/freebsd-ports/pull/158

security/vuxml: Document multiple vulnerabilities in ClamAV

security/vuxml: Document Go vulnerabilities

security/vuxml: Fix typo in my previous commit

Reported by:	dan@langille.org(via email)

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: Document GNUTLS-SA-2020-07-14

Security:	https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14

security/vuxml: Document phpmyfaq vulnerabilities

security/vuxml: add www/*chromium < 110.0.5481.77

Approved by:	rene (mentor)
Obtained
from:	https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html

security/vuxml: update PostgreSQL CVE-2022-41862

The problem is with libpq, part of the postgresql-client packages.

security/vuxml: add entry for PostgreSQL CVE-2022-41862

security/vuxml: Record grafana{8,9} vulnerabilities

CVE-2022-39324 and CVE-2022-23552

security/vuxml: Document LibreSSL vulnerability

security/vuxml: Fix affected version of tightvnc

Forgot to include PORTREVISION.

Reported by:	jbeich

security/vuxml: mark xorg-server < 21.1.7,1 as vulnerable

security/vuxml: Document TightVNC multiplevulnerability

security/vuxml: Document new OpenSSL vulnerabilities

security/vuxml: Document django multiple vulnerabilities

security/vuxml: Fix kafka version

Use 3.3.2 since we don't have the 3.4.x branch.

Fixes:	37508462426c3674c0b32cc7e8cb38dbafc2ecd5

security/vuxml: Register net/kafka stack overflow vulnerability

CVE-2020-36518

PR:	269170

security/vuxml: Register sysutils/node_exporter vulnerability

CVE-2022-46146

Note that in

https://cgit.freebsd.org/ports/commit/?id=8b5d2b9a9ec7985158a814e2cdf9022d785b9090

three CVEs are mentioned: CVE-2022-27191 CVE-2022-27664 CVE-2022-46146

However, according to: https://github.com/prometheus/node_exporter/pull/2488
node_exported is not really affected by those Go vulnerabilities. However
the dependencies were bumped anyway.

security/vuxml: fix a typo

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/155

security/vuxml: Belatedly record vulnerabilities fixed in asterisk 18.15.1

security/vuxml: Add audio/py-spotipy <= 2.22.0

Security:	CVE-2023-23608

security/vuxml: Mark zeek < 5.0.6 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v5.0.6

This release fixes the following potential DoS vulnerabilities:

 - A missing field in the SMB FSControl script-land record could
   cause a heap buffer overflow when receiving packets containing
   those header types.

 - Receiving a series of packets that start with HTTP/1.0 and then
   switch to HTTP/0.9 could cause Zeek to spend a large amount of
   time processing the packets.

 - Receiving large numbers of FTP commands sequentially from the
   network with bad data in them could cause Zeek to spend a large
   amount of time processing the packets, and generate a large
   amount of events.

Reported by:	Tim Wojtulewicz

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document CVE-2021-42835 for
multimedia/plexmediaserver{-plexpass} < 1.25.0

PR:		269226
Reported by:	grahamperrin

security/vuxml: add net-mgmt/prometheus basic authentication bypass

CVE-2022-46146

PR:	269153
Reported by:	dor.bsd@xm0.uk (maintainer)

security/vuxml: add www/*chromium < 109.0.5414.119

Obtained
from:	https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html

security/vuxml: Document CVE-2018-21232 for devel/re2c < 2.0

PR:		269147
Reported by:	grahamperrin

security/vuxml: Record gitea vulnerability

PR:		269131

security/vuxml: register dns/powerdns-recursor vulnerability

CVE-2023-22617

PR:	269116

security/vuxml: register net/krill DoS vulnerability

CVE-2023-0158

PR:	269050

security/vuxml: register www/awstats vulnerability

PR:	269051

security/vuxml: register net/eternalterminal vulnerabilities

CVE-2022-48257 and CVE-2022-48258

PR:	269079

security/vuln: Fix file

It didn't pass `make validate`.

security/vuxml: register shells/fish vulnerability

Arbitrary code execution if the attacker can convince the user to cd to
a directory the attacker controls.

CVE-2022-20001

PR: 263506

security/vuxml: Document 2023Q1 MySQL vulns

security/vuxml: Document vulnerabilities in phpmyfaq

security/vuxml: Document multiple vulnerabilities in rack

security/vuxml: Add redis6 as affecting package to
5fa68bd9-95d9-11ed-811a-080027f5fec9

security/vuxml: Document www/apache24 vulnerabilities

security/vuxml: Document multiple vulnerabilities in redis

security/vuxml: register security/keycloak vulnerability

Two Xstream related CVEs that might cause a DoS attack:

 * CVE-2022-40151
 * CVE-2022-41966

PR:	268939

security/vuxml: add security/tor < 0.4.7.13 for TROVE-2022-002

Obtained from:	https://gitlab.torproject.org/tpo/core/tor/-/issues/40730

security/vuxml: Correct range for devel/viewvc-devel

Changing a - to a . in the version

PR:		268754

security/vuxml: Document arbitary shell command execution vulnerability in Emacs

security/vuxml: cassandra3 multiple vulnerabilities

CVE-2022-42003
CVE-2022-4200
CVE-2022-25857
CVE-2019-2684
CVE-2020-7238
CVE-2022-24823
CVE-2021-44521
CVE-2015-0886

PR:	267624

security/vuxml: mark xorg-server < 21.1.5,1 as vulnerable

security/vuxml: document gitlab-ce vulnerabilities

security/vuxml: add www/*chromium < 109.0.5414.74

Obtained
from:	https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html

security/vuxml: Fix `make validate`

PR:		268837

security/vuxml: Add 2023 to the main XML file

PR:		268837

security/vuxml: Add net-mgmt/cacti vulnerability

A command injection vulnerability allows an unauthenticated user to execute
arbitrary code on a server running Cacti, if a specific data source was selected
for any monitored device.

PR:	268742

security/vuxml: amend entry adding CVE-2023-22456 in devel/viewvc-devel

PR:		268754
Security:	CVE-2023-22456

security/vuxml: add an entry for CVE-2023-22464 in devel/viewvc-devel

Security:	CVE-2023-22464

security/vuxml: add an entry for CVE-2022-4170 in x11/rxvt-unicode

Security:	CVE-2022-4170

security/vuxml: Document Gitea multiple vulnerabilities

PR:		268667

security/vuxml: Remove the uncorrect <cvsname> line in my previous commit

security/vuxml: Document Webtrees vulnerability

PR:		267466

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: Document Netdata multiple vulnerabilities

security/vuxml: Document FreeRDP multiple vulnerabilities

PR:		268539

security/vuxml: Document Gitea multiple vulnerabilities

PR:		268512

VuXML: fix typo in 2021 entry for accountsservice

Fixes:                 d227a2fea96e Document accountsservice vulnerability
Approved by:           ports-secteam (riggs)
Differential revision: https://reviews.freebsd.org/D37721

security/vuxml: Document typo3 multiple vulnerabilities

security/vuxml: add www/*chromium < 108.0.5359.124

Obtained
from:	https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html

security/vuxml: Document multiple vulnerabilities in cURL.

security/vuxml: Document vulnerabilities in phpmyfaq

security/vuxml: Document vulnerabilities in net/traefik