diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 8b880c07b232..aeb8e81e43d6 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,61 +1,89 @@ + + devel/viewvc-devel is vulnerable to cross-site scripting + + + py37-viewvc-devel + py38-viewvc-devel + py39-viewvc-devel + 1.3.0-20230104 + + + + +

C. Michael Pilato reports:

+
+

security fix: escape revision view copy paths (#311) [CVE-2023-22464]

+
+ + + + CVE-2023-22464 + https://nvd.nist.gov/vuln/detail/CVE-2023-22464 + + + 2023-01-04 + 2023-01-05 + + + rxvt-unicode is vulnerable to a remote code execution rxvt-unicode 9.31

Marc Lehmann reports:

The biggest issue is resolving CVE-2022-4170, which allows command execution inside urxvt from within the terminal (that means anything that can output text in the terminal can start commands in the context of the urxvt process, even remotely).

 CVE-2022-4170 https://nvd.nist.gov/vuln/detail/CVE-2022-4170 2022-12-05 2023-01-03 gitea -- multiple issues gitea 1.18.0

The Gitea team reports:

Remove ReverseProxy authentication from the API

Support Go Vulnerability Management

Forbid HTML string tooltips

 https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/ https://github.com/go-gitea/gitea/releases/tag/v1.18.0 2022-08-23 2023-01-02