security/vuxml: add www/*chromium < 126.0.6478.126

Obtained
from:	https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html

security/vuxml: Update Emacs arbitrary shell code vulnerability entry

- Tweak title
- Add vulnerable emacs-devel packages

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Emacs arbitrary shell code evaluation

Emacs 29.4 is an emergency bugfix release intended to fix a security
vulnerability.  Arbitrary shell commands are no longer run when turning
on Org mode in order to avoid running malicious code.

Reviewed by:	ashish, yasu
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D45702

security/vuxml: Document Azure Identity Libraries vuln in net/traefik

security/vuxml: add qt5-webengine >= 5.15.17.p2_1

security/vuxml: add qt6-webengine < 6.7.2

security/vuxml: document two openvpn < 2.6.11 vulns

Security:	142c538e-b18f-40a1-afac-c479effadd5c
Security:	CVE-2024-5594
Security:	CVE-2024-28882

security/vuxml: add www/*chromium < 126.0.6478.114

Obtained
from:	https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html

security/vuxml: add www/*chromium < 126.0.6478.54

Obtained
from:	https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html

security/vuxml: update nginx 1.26.0 security issues

security/vuxml: Add www/forgejo vulnerability

CVE-2024-24789
NVD assessment not yet provided

PR: 299781

security/vuxml: Document vulnerability in net/traefik

Details:
- Document Unexpected behavior with IPv4-mapped IPv6 addresses in
  net/traefik before 2.11.4, see:
  https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx

security/vuxml: Document go language vulnerabilities

security/vuxml: document gilab vulnerabilities

security/vuxml: Document plasma[56]-plasma-workspace vuln

security/vuxml: Report php composer vulnerabilities.

Obtained
from:	https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
		https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf

security/vuxml: record kanboard vulnerability

CVE-2024-36399

NVD assessment not yet provided.

security/vuxml: add cyrus-imapd* < 3.8.3

Obtained
from:	https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html

security/vuxml: add www/*chromium < 125.0.6422.141

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html

security/vuxml: add www/nginx-devel < 1.27.0

Obtained:	https://nginx.org/en/security_advisories.html

security/vuxml: add www/*chromium < 125.0.6422.112

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html

security/vuxml: Document OpenSSL Use-after-free

security/vuxml: Fix typo

security/vuxml: document electron29 use after free in Dawn

Obtained from:	https://github.com/electron/electron/releases/tag/v29.4.1

security/vuxml: document electron28 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v28.3.2

security/vuxml: Document CVE-2024-36048 for qt[56]-networkauth

security/vuxml: documented gitlab vulnerabilities

security/vuxml: add www/*chromium < 125.0.6422.76

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html

security/vuxml: openfire admin console bypass

NVD assessment not yet provided.

PR:		277054

security/vuxml: Document Roundcube XSS

security/vuxml: Fix up 54181a8860c8

Reported by:	dbaio

security/vuxml: Document vulnerabilities in www/qt5-webengine

security/vuxml: Add arti security issues

Security:	CVE-2024-35313 and CVE-2024-35312

security/vuxml: Document OpenSSL 3.x vuln (Low)

security/vuxml: document electron29 setuid vulnerability

Obtained from:	https://github.com/electron/electron/releases/tag/v29.4.0

security/vuxml: Document www/qt6-webengine vulnerabilities

security/vuxml: Document devel/qt6-base vulnerability

dns/dnsdist: update to 1.9.4 (fixes CVE-2024-25581)

PR: 278954
Approved by: submitter is maintainer

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2023-45733
Security:	CVE-2023-45745
Security:	CVE-2023-46103
Sponsored by:	The FreeBSD Foundation

security/vuxml: add www/*chromium < 124.0.6367.207

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html

security/vuxml: Document lang/go vulnerability

security/vuxml: add www/*chromium < 124.0.6367.201

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html

security/vuxml: Document vulnerability in postgresql.

CVE-2024-4317: Restrict visibility of "pg_stats_ext" and "pg_stats_ext_exprs"
entries to the table owner

https://www.postgresql.org/support/security/CVE-2024-4317/

security/vuxml: Document tailscale vulnerability

security/vuxml: document electron29 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v29.3.3

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron29 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v29.3.2

security/vuxml: add www/*chromium < 124.0.6367.118

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html

security/vuxml: Document ACE vulnerability in math/R

In versions released before 4.4.0, the R statistical program is
vulnerable to CVE-2024-27322, which allows maliciously crafted RDS (R
Data Serialization) files or R packages to run arbitrary code.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document buffer overflow in korean/hcode

Before ko-hcode-2.1.3_2, the port was affected by CVE-2024-34020, where
a buffer overflow can be exploited to (at least) crash the program.

security/vuxml: CVEs affecting www/glpi < 10.0.15

CVE-2024-31456 and CVE-2024-29889 were fixed in GLPI 10.0.15.

PR:		278641
PR:		278642

security/vuxml: Add powerdns-recursor DOS

* CVE-2024-25583

A crafted response from an upstream server the recursor has been configured to
forward-recurse to can cause a Denial of Service in the Recursor. The default
configuration of the Recursor does not use recursive forwarding and is not
affected.

PR:	278564

security/vuxml: Amend previous commit 3b46eb72e1df

Add a missing paragraph, which was not found by "make validate" before
committing.

Fixes:	3b46eb72e1df security/vuxml: Document www/py-social-auth-app-django
vulnerability

security/vuxml: Document www/py-social-auth-app-django vulnerability

security/vuxml: add www/*chromium < 124.0.6367.78

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html

security/vuxml: correct historical www/glpi entries

Several older entries for www/glpi had incorrect version ranges, causing
pkg audit to complain about false positives.  This corrects the older
entries and adds some missing ones.

PR:	        278549

security/vuxml: Document matrix-synapse vulnerability

security/vuxml: document gitlab vulnerabilities

security/vuxml: add CVEs related to www/glpi

New CVEs for GLPI which were corrected in versions 10.0.11, 10.0.12 and
10.0.13.

PR:		278548
PR:             278090

security/vuxml: Document arbitrary memory address read vulnerability in Ruby

security/vuxml: document sdl2_sound vulns

PR:		278491

security/vuxml: add www/*chromium < 124.0.6367.60

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html

security/vuxml: Document possible DoS attack valnerability in ClamAV

security/vuxml: Document Jenkins Security Advisory 2024-04-17

Sponsored by:	The FreeBSD Foundation

security/vuxml: document electron{27,28,29} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.11,
		https://github.com/electron/electron/releases/tag/v28.3.1,
		https://github.com/electron/electron/releases/tag/v29.3.1

security/vuxml: Add entries for php8*

Approved by:	portmgr (blanket)

security/vuxml: document PuTTY/FileZilla NIST P521 private key recovery

Security:       080936ba-fbb7-11ee-abc8-6960f2492b1d
Security:       CVE-2024-31497

security/vuxml: Document go language vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.122

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html

security/vuxml: document electron{27,28} out of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.10,
		https://github.com/electron/electron/releases/tag/v28.3.0

security/vuxml: Document OpenSSL vulnerability

security/vuxml: add www/forgejo HTTP/2 vulnerability

PR:	278119

security/vuxml: add net/jose DoS vulnerability

PR:	278243

security/vuxml: added gitlab 16.10.2, 16.9.4, 16.8.6 updates

security/vuxml: Add wordpress vulnerability

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: document electron{27,28} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.9,
		https://github.com/electron/electron/releases/tag/v28.2.10

security/vuxml: add www/*chromium < 123.0.6312.105

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html

security/vuxml: close off-by-one gap after 1f3a9629b7a4

xwayland-devel-21.0.99.1.672 *is* vulnerable but wasn't ever in ports/.

security/vuxml: add xwayland-devel to 9661a37b4dff list

security/vuxml: Document recent xorg-server and xwayland vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG

security/vuxml: Document Jenkins Security Advisory 2024-03-20

Sponsored by:	The FreeBSD Foundation

security/vuxml: Fix vid d58726ff-ef5e-11ee-8d8e-080027a5b8e9

Temporarily remove cvename tag as it is not a valid CVE name and breaks
vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: reference FreeBSD SA-24:03.unbound

Add a reference to FreeBSD SA-24:03.unbound (announced 2024-03-28) to
the vuxml entry for Unbound CVE-2023-50387 and CVE-2023-50868.

Unbound was updated to 1.19.1 in FreeBSD 14.0-RELEASE-p6 and in FreeBSD
13.2-RELEASE-p11.  FreeBSD 13.3 was not affected (Unbound 1.19.1 was
included in the release).

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: Register net/quiche vulnerabilities

PR:		277692
Reported by:	Ralf van der Enden <tremere@cainites.net>
Approved by:	junho.choi@gmail.com (maintainer)

security/vuxml: document electron{27,28} object lifecycle issue in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.8,
		https://github.com/electron/electron/releases/tag/v28.2.9

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.86

Obtained
from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html

security/vuxml: add phpmyfaq < 3.2.6

security/vuxml: Document vulns in Emacs prior to version 29.3

Obtained
from:	https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3
Sponsored by:	The FreeBSD Foundation

security/vuxml: Remove references to non-existent package.

There never was a grafana10 package.  Initially there was www/grafana
providing grafana-8.x.  Then a www/grafana9 port was added providing
grafana-9.x.  The www/grafana port was subsequently obsoleted, and
then revived, now providing grafana-10.x.  I believe the idea is that
going forwards, www/grafana will provide the latest stable release
version and there may be numbered ports for older major versions.

PR:	277631

security/vuxml: Add www/grafana and www/grafana9 data sourceprivilege escalation

PR:	277631

security/vuxml: add www/*chromium < 123.0.6312.58

Obtained
from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html

security/shibboleth-idp: Document CAS SSRF vulnerability

security/vuxml: document mongodb* vuln: CVE-2024-1351

Improper Certificate Validation

Security:	CVE-2024-1351

security/vuxml: Document www/varnish7 vuln: CVE-2023-43622

security/vuxml: remove duplicated entry, see
3bac9fee140f64f562008b81ea2f2391b3fca116

Reported by:	flo@smeets.xyz

security/vuxml: Add amavisd-new vulnerability

security/vuxml: document typo3-{11,12} security issues

PR:		277117
Reported by:	 Helmut Ritter <freebsd-ports@charlieroot.de>