security/vuxml: document electron{32,33} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.3.2,
		https://github.com/electron/electron/releases/tag/v33.4.2

security/vuxml: document unit* vulnerabilities

security/vuxml: Fix entry

Add missing </p> tag.

Reported by:	dan@langille.org
Fixes:		003195a3c754204bc61aaa39fea85fd62004b014

vuxml: Document vim code execution

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 133.0.6943.141

Obtained
from:	https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html

security/vuxml: Update affected versions for recent Emacs entry

For entry e60e538f-e795-4a00-b475-cc85a7546e00, even though
CVE-2025-1244 was created recently, the workaround was committed to the
upstream master branch much earlier.

https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f

After confirming details with an upstream developer, update the affected
editors/emacs-devel package versions.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add <= 0.28.0 exiv2 < 0.28.4

Add Med 5.3 CVE-2025-26623 for graphics/exiv2
https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7

security/vuxml: Add entries for Emacs CVE-2024-53920 and CVE-2025-1244

Security:	CVE-2024-53920
Security:	CVE-2025-1244
Sponsored by:	The FreeBSD Foundation

security/vuxml: Add exim SQL injection vulnerability

CVE-2025-26794

 * Base Score:	7.5 HIGH
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

security/vuxml: add FreeBSD SA issued on 2025-02-21

FreeBSD-SA-25:05.openssh affects all supported versions of FreeBSD

security/vuxml: add www/*chromium < 133.0.6943.126

Obtained
from:	https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html
Obtained
from:	https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html
Obtained
from:	https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html

security/vuxml: document vscode multiple vulnerabilities

Obtained from:	https://github.com/microsoft/vscode/releases/tag/1.97.1

security/vuxml: Document vulnerability in security/openvpn-auth-ldap

security/vuln: Add entry for PostgreSQL

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document new Intel CPU vulnerabilities

Intel has disclosed new CPU vulnerabilities in the release notes for
microcode-20250211.

Reference:	https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250211
Security:	CVE-2024-31068
Security:	CVE-2024-36293
Security:	CVE-2023-43758
Security:	CVE-2024-39355
Security:	CVE-2024-37020
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document OpenSSL 3.2+ vuln

security/vuxml: Entries for mozilla products

CVE-2025-10{09,10,11,12,13,14,15,16,17,18,19,20}

security/vuxml: Document MariaDB InnoDB vuln

security/vuxml: Add graphics/libcaca < 0.99.b20

security/vuxml: add entry for net-mgmt/cacti < 1.2.29

security/vuxml: document www/nginx* vulnerability

security/vuxml: Add www/qt6-webengine < 6.8.2

security/vuxml: Update entries for redis and valkey

Add affected range for redis-devel package.

security/vuxml: add www/*chromium < 132.0.6834.159

Obtained
from:	https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html

security/vaultwarden: Security update to 1.33.0

Also added CVE IDs to security/vuxml vaulwarden entry.

PR:		 284399
Reported by:	 foudfou

security/vuxml: Document net-im/dendrite vulneraability

security/vuxml: add FreeBSD SAs issued on 2025-01-29

FreeBSD-SA-25:01.openssh affects FreeBSD 14.1
FreeBSD-SA-25:02.fs affects all supported versions of FreeBSD
FreeBSD-SA-25:03.etcupdate affects all supported versions of FreeBSD
FreeBSD-SA-25:04.ktrace affects FreeBSD 14.2

security/vuxml: fix whitespace errors in recent oauth2-proxy entry

Turn some spaces into tabs to make `make validate` happy.  The errors
were introduced in ab5f837462e075723c1be8573d178751b2ba2ede earlier
today.

Pointy hat to:	rm

security/vuxml: add www/oauth2-proxy < 7.8.0 entry

PR:		284059
Reported by:	Matthias Wolf <freebsd@rheinwolf.de>

security/vaultwarden: Register <= 1.32.7 vulns

security/vuxml: add www/*chromium < 132.0.6834.110

Obtained
from:	https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html
Obtained
from:	https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.3.0

security/vuxml: document electron33 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v33.3.2

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document possbile denial-of-service vulnerability in clamav

security/vuxml: document electron32 type confusion in v8 vulnerability

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.8

security/vuxml: Document lang/go* vulnerabilities

PR:		284181

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.7

security/vuxml: Document age arbitrary binary execution vulnerability.

security/vuxml: mention security/openvpn username/password length bugfix of
v2.6.13

I am not aware of a CVE number yet.

Security:	47bc292a-d472-11ef-aaab-7d43732cb6f5

security/vuxml: Fix entry 163edccf-d2ba-11ef-b10e-589cfc10a551

Fixes:	e39886d24184 security/vuxml: add net/rsync vulnerabilities
Sponsored by:	The FreeBSD Foundation

security/vuxml: add net/rsync vulnerabilities

security/vuxml: Update 2025-01-13 keycloak entry to fix `make validate`

Reported by:	garga
Sponsored by:	The FreeBSD Foundation

security/vuxml: Add devel/git vulnerabilities

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Add record for net/keycloak

CVE-2024-11736 Unrestricted admin use of system and environment variables
CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers

Security:	CVE-2024-11734
Security:	CVE-2024-11736
PR:		284058

security/vuxml: add asterisk{18,20} vulns

CVE-2024-53566: Path traversal

 * Base Score:	5.5 MEDIUM
 * Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

security/vuxml: Document two valnerabilities in redis and valkey

While here, update copyright year

security/vuxml: document gitlab vulnerabilities

security/vuxml: Fix sqlite range

PR:		283830
Reported by:	John Hein <jcfyecrayz@liamekaens.com>

security/vuxml: Update open-motif entry to reflect fix in 2004

Release notes states:

2.2.4 October 2004
a. Fixed vulnerabilities in libXpm code [CVE numbers CAN-2004-0687
   (integer overflows) and CAN-2004-0688 (stack overflows)].

security/vuxml: Note Xpm update in open-motif-devel

Upstream open-motif updated built-in Xpm to 3.5.12 in upstream commit
b100c321 making it no longer vulnerable.

security/vuxml: TOCTOU Vulnerability in www/apache*

CVE-2024-56337

security/vuxml: www/kanboard vulnerability

Insufficient session validation.

security/vuxml: Document Vaultwarden vulnerability

security/vuxml: add www/*chromium < 131.0.6778.204

Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html

security/vuxml: Document liboqs vulnerability

security/vuxml: fix parse errors

Fix parse errors introduced in 96ddbb42b98fcb6022729ea28cd6725fcfdc4597.

security/vuxml: add records for www/gitea < 1.22.6

https://github.com/go-gitea/gitea/pull/32810
https://github.com/advisories/GHSA-v778-237x-gjrc
https://github.com/go-gitea/gitea/pull/32791
https://github.com/go-gitea/gitea/pull/32654
https://github.com/go-gitea/gitea/pull/32531
https://github.com/go-gitea/gitea/pull/32473

PR:	283389

security/vuxml: add records for www/forgejo < 9.0.3 and www/forgejo7 < 7.0.12

https://codeberg.org/forgejo/forgejo/pulls/5974
https://codeberg.org/forgejo/forgejo/pulls/6248
https://codeberg.org/forgejo/forgejo/pulls/6249

PR:	283388

security/vuxml: Document net-im/py-matrix-synapse vulnerability

Signed-off-by: Sascha Biberhofer <sascha.biberhofer@skyforge.at>

PR:		283350
Reviewed by:	ashish

security/vuxml: Fix range for thunderbird vulnerability

PR:		283357
Reported by:	John Hein <jcfyecrayz@liamekaens.com>

security/vuxml: Mark zeek < 7.0.5 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.5

This release fixes the following potential DoS vulnerability:

 - Large QUIC packets can cause Zeek to overflow memory and potentially
   crash. Due to the possibility of receiving these packets from
   remote hosts, this is a DoS risk.

Reported by:	Tim Wojtulewicz

textproc/halibut: update 1.2 → 1.3

PR:	282213

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.139

Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html
Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html

security/vuxml: Add mozilla vulnerabilities

 * CVE-2024-11692
 * CVE-2024-11696
 * CVE-2024-11697
 * CVE-2024-11699

security/vuxml: Add www/qt6-webengine < 6.7.3_3

security/vuxml: Document gstreamer1-plugins* < 1.24.10

security/vuxml: Add zabbix-frontend vulnerability

 * Base Score:  9.9 CRITICAL
 * Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

security/vuxml: document electron33 inappropriate implementation in extensions

Obtained from:	https://github.com/electron/electron/releases/tag/v33.2.1

security/vuxml: security/vuxml: Document Jenkins Security Advisory 2024-11-27

Sponsored by:	The FreeBSD Foundation

net/keycloak: document multiple vulnerabilities

Security:	CVE-2024-9666 CVE-2024-10039 CVE-2024-10270
Security:	CVE-2024-10451 CVE-2024-10492
PR:		282983

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.85

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html

security/vuxml: Add www/qt6-webengine < 6.7.3_2

security/vuxml: Add www/qt5-webengine < 5.15.18p5

security/vuxml: Add x11-servers/xorg-server, x11-servers/xwayland

PR:		282415

security/vuxml: Add vaultwarden

Vaultwarden -- Multiple vulnerabilities

PR:		282795
Reported by:	Bernard Spil

security/vuxml: Add mongodb vulnerability

Buffer over-read.

security/vuxml: Document vaultwarden vulnerabilities

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.5

security/vuxml: add www/*chromium < 131.0.6778.69

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.5

security/vuxml: Add CVEs for PostreSQL

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.4

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2024-10-29

FreeBSD-SA-24:17.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:18.ctl affects all supported versions of FreeBSD
FreeBSD-SA-24:19.fetch affects all supported versions of FreeBSD

security/vuxml: Document element-web vulnerabilities

Security:	CVE-2024-51749
Security:	CVE-2024-51750

security/vuxml: Document matrix-js-sdk vulnerability

Security:	CVE-2024-50336

security/vuxml: Document icinga2 vulnerability

security/vuxml: Document new Intel CPU vulnerabilities

Intel has disclosed new CPU vulnerabilities in the release notes for
microcode-20241112.  This release also includes updates to previous
microcode updates for CVE-2024-24968 and CVE-2024-23984.

Reference:	https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20241112
Security:	CVE-2024-21820
Security:	CVE-2024-21853
Security:	CVE-2024-23918
Security:	CVE-2024-23984 (updated microcode)
Security:	CVE-2024-24968 (updated microcode)
Sponsored by:	The FreeBSD Foundation

security/vuxml: add CVE-2018-10195, CVE-2020-29074

security/vuxml: Document tnef vulnerabilities

PR:		282228

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.3

security/vuxml: Document gstreamer1-rtsp-server

Only affected if assertions are enabled, which we don't do by default.

security/vuxml: add www/*chromium < 130.0.6723.116

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html

security/vuxml: Add record for devel/libqb < 2.0.8 CVE-2023-39976

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long
log messages because the header size is not considered.
https://nvd.nist.gov/vuln/detail/CVE-2023-39976

PR:	282536

security/vuxml: add www/*chromium < 130.0.6723.91

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html