Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-15861: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/expr.c
Commit date: 2018-08-03 16:14:16 +0100
Commit message: xkbcomp: Don't falsely promise from ExprResolveLhs

Every user of ExprReturnLhs goes on to unconditionally dereference the
field return, which can be NULL if xkb_intern_atom fails. Return false
if this is the case, so we fail safely.

testcase: splice geometry data into interp

Signed-off-by: Daniel Stone <daniels@collabora.com>

Diff: diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c
index 91713daec..b5ab71708 100644
--- a/src/xkbcomp/expr.c
+++ b/src/xkbcomp/expr.c
@@ -40,11 +40,11 @@ ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,
     switch (expr->expr.op) {
     case EXPR_IDENT:
         *elem_rtrn = NULL;
         *field_rtrn = xkb_atom_text(ctx, expr->ident.ident);
         *index_rtrn = NULL;
-        return true;
+        return (*field_rtrn != NULL);
     case EXPR_FIELD_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);
         *index_rtrn = NULL;
         return true;

Vulnerable code:         return true;
Fixed code:         return (*field_rtrn != NULL);
CVE-2018-15862: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/expr.c
Commit date: 2018-08-03 16:14:16 +0100
Commit message: xkbcomp: Don't explode on invalid virtual modifiers

testcase: 'virtualModifiers=LevelThreC'

Signed-off-by: Daniel Stone <daniels@collabora.com>

Diff: diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c
index 5d43cbaa9..91713daec 100644
--- a/src/xkbcomp/expr.c
+++ b/src/xkbcomp/expr.c
@@ -99,10 +99,12 @@ LookupModMask(struct xkb_context *ctx, const void *priv, xkb_atom_t field,
 
     if (type != EXPR_TYPE_INT)
         return false;
 
     str = xkb_atom_text(ctx, field);
+    if (!str)
+        return false;
 
     if (istreq(str, "all")) {
         *val_rtrn  = MOD_REAL_MASK_ALL;
         return true;
     }

Fixed code:     if (!str)
        return false;
CVE-2018-15863: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/compat.c
Commit date: 2018-08-03 16:13:35 +0100
Commit message: xkbcomp: Don't crash on no-op modmask expressions

If we have an expression of the form 'l1' in an interp section, we
unconditionally try to dereference its args, even if it has none.

Signed-off-by: Daniel Stone <daniels@collabora.com>

Diff: diff --git a/src/xkbcomp/compat.c b/src/xkbcomp/compat.c
index 9ae26cd5f..bd587c8db 100644
--- a/src/xkbcomp/compat.c
+++ b/src/xkbcomp/compat.c
@@ -262,11 +262,12 @@ ResolveStateAndPredicate(ExprDef *expr, enum xkb_match_operation *pred_rtrn,
     }
 
     *pred_rtrn = MATCH_EXACTLY;
     if (expr->expr.op == EXPR_ACTION_DECL) {
         const char *pred_txt = xkb_atom_text(info->ctx, expr->action.name);
-        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn)) {
+        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn) ||
+            !expr->action.args) {
             log_err(info->ctx,
                     "Illegal modifier predicate \"%s\"; Ignored\n", pred_txt);
             return false;
         }
         expr = expr->action.args;

Vulnerable code:         if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn)) {
Fixed code:         if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn) ||
            !expr->action.args) {
CVE-2018-15864: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: Other
Files changed: src/xkbcomp/parser.y
Commit date: 2018-08-03 16:13:35 +0100
Commit message: parser: Don't set more maps when we don't have any

If the scanner indicates that we might have something which looks like a
map, but the parser in fact fails to create that map, we will try to
access the map regardless. Stop doing that.

testcase: 'xkb_keymap {' -> '#kb_keymap'

Signed-off-by: Daniel Stone <daniels@collabora.com>

Diff: diff --git a/src/xkbcomp/parser.y b/src/xkbcomp/parser.y
index b555bc254..296ce19ef 100644
--- a/src/xkbcomp/parser.y
+++ b/src/xkbcomp/parser.y
@@ -237,13 +237,13 @@ resolve_keysym(const char *name, xkb_keysym_t *sym_rtrn)
  * This does mean that if we e.g. always use the first map, the file may
  * contain complete garbage after that. But it's worth it.
  */
 
 XkbFile         :       XkbCompositeMap
-                        { $$ = param->rtrn = $1; param->more_maps = true; }
+                        { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; }
                 |       XkbMapConfig
-                        { $$ = param->rtrn = $1; param->more_maps = true; YYACCEPT; }
+                        { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; YYACCEPT; }
                 |       END_OF_FILE
                         { $$ = param->rtrn = NULL; param->more_maps = false; }
                 ;
 
 XkbCompositeMap :       OptFlags XkbCompositeType OptMapName OBRACE
@@ -770,10 +770,11 @@ parse(struct xkb_context *ctx, struct scanner *scanner, const char *map)
     XkbFile *first = NULL;
     struct parser_param param = {
         .scanner = scanner,
         .ctx = ctx,
         .rtrn = NULL,
+        .more_maps = false,
     };
 
     /*
      * If we got a specific map, we look for it exclusively and return
      * immediately upon finding it. Otherwise, we need to get the

Vulnerable code:                         { $$ = param->rtrn = $1; param->more_maps = true; }
                        { $$ = param->rtrn = $1; param->more_maps = true; YYACCEPT; }
Fixed code:                         { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; }
                        { $$ = param->rtrn = $1; param->more_maps = !!param->rtrn; YYACCEPT; }
        .more_maps = false,
CVE-2021-44078: Incorrect Comparison (CWE-697)
value: An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 8.1
Published: 2021-12-26T05:15Z
Repository: https://github.com/unicorn-engine/unicorn
Language: C
Files changed: qemu/accel/tcg/translate-all.c, uc.c
Commit date: 2021-11-23 23:22:53 +0100
Commit message: Fix wrong offset used in split_region

Diff: diff --git a/qemu/accel/tcg/translate-all.c b/qemu/accel/tcg/translate-all.c
index ac14d902..c0488ca9 100644
--- a/qemu/accel/tcg/translate-all.c
+++ b/qemu/accel/tcg/translate-all.c
@@ -983,11 +983,13 @@ static void tb_htable_init(struct uc_struct *uc)
 
 static void uc_invalidate_tb(struct uc_struct *uc, uint64_t start_addr, size_t len) 
 {
     tb_page_addr_t start, end;
 
-    // GVA to GPA (GPA -> HVA via page_find, HVA->HPA via host mmu)
+    // GVA to GPA 
+    // (GPA -> HVA via memory_region_get_ram_addr(mr) + GPA + block->host,
+    // HVA->HPA via host mmu)
     start = get_page_addr_code(uc->cpu->env_ptr, start_addr) & (target_ulong)(-1);
     
     // For 32bit target.
     end = (start + len) & (target_ulong)(-1);
 
diff --git a/uc.c b/uc.c
index 591ed69c..2e1add22 100644
--- a/uc.c
+++ b/uc.c
@@ -1088,11 +1088,12 @@ static bool split_region(struct uc_struct *uc, MemoryRegion *mr,
         return false;
     }
 
     QLIST_FOREACH(block, &uc->ram_list.blocks, next)
     {
-        if (block->offset <= mr->addr &&
+        // block->offset is the offset within ram_addr_t, not GPA
+        if (block->mr->addr <= mr->addr &&
             block->used_length >= (mr->end - mr->addr)) {
             break;
         }
     }
 

Vulnerable code:     // GVA to GPA (GPA -> HVA via page_find, HVA->HPA via host mmu)
        if (block->offset <= mr->addr &&
Fixed code:     // GVA to GPA 
    // (GPA -> HVA via memory_region_get_ram_addr(mr) + GPA + block->host,
    // HVA->HPA via host mmu)
        // block->offset is the offset within ram_addr_t, not GPA
        if (block->mr->addr <= mr->addr &&
CVE-2022-29693: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2022-06-02T14:15Z
Repository: https://github.com/unicorn-engine/unicorn
Language: Unknown
Commit date: 2022-04-11 10:44:10 +0200
Commit message: Merge pull request #1587 from liyansong2018/dev

Fix https://github.com/unicorn-engine/unicorn/issues/1586
CVE-2020-1920: Incorrect Comparison (CWE-697)
value: A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 7.5
Published: 2021-06-01T14:15Z
Repository: https://github.com/facebook/react-native
Language: JavaScript
Files changed: Libraries/Blob/URL.js
Commit date: 2021-04-30 13:07:53 +0100
Commit message: Update validateBaseUrl to use latest regex

Summary:
Updating the regex to avoid a potential regular expression denial-of-service vulnerability.

Changelog: Update validateBaseUrl to use a more robust regular expression. Fixes CVE-2020-1920, GHSL-2020-293

Reviewed By: lunaleaps

Differential Revision: D25507604

fbshipit-source-id: c36a03c456881bc655c861e1a2c5cd41a7127c9d

Diff: diff --git a/Libraries/Blob/URL.js b/Libraries/Blob/URL.js
index f2b6f7f27..df186f36d 100644
--- a/Libraries/Blob/URL.js
+++ b/Libraries/Blob/URL.js
@@ -105,11 +105,11 @@ export class URLSearchParams {
   }
 }
 
 function validateBaseUrl(url: string) {
   // from this MIT-licensed gist: https://gist.github.com/dperini/729294
-  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(
+  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
     url,
   );
 }
 
 export class URL {

Vulnerable code:   return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(
Fixed code:   return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
CVE-2023-26044: Insufficient Information (NVD-CWE-noinfo)
value: react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.  Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-05-17T18:15Z
Repository: https://github.com/reactphp/http
Language: Unknown
Commit date: 2023-02-27 15:05:56 +0100
Commit message: Merge pull request from GHSA-95x4-j7vc-h8mf

Stop parsing multipart request bodies once the configured limit of form fields and files has been reached
CVE-2024-32005: Insufficient Information (NVD-CWE-noinfo)
value: NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-12T21:15Z
Repository: https://github.com/zauberzeug/nicegui
Language: Python
Files changed: nicegui/nicegui.py
Commit date: 2024-04-12 14:27:19 +0200
Commit message: prevent local file access (see security advisory GHSA-mwc7-64wg-pgvj)

Diff: diff --git a/nicegui/nicegui.py b/nicegui/nicegui.py
index f93c77dd..45b562a6 100644
--- a/nicegui/nicegui.py
+++ b/nicegui/nicegui.py
@@ -94,10 +94,14 @@ def _get_component(key: str) -> FileResponse:
 
 @app.get(f'/_nicegui/{__version__}' + '/resources/{key}/{path:path}')
 def _get_resource(key: str, path: str) -> FileResponse:
     if key in resources:
         filepath = resources[key].path / path
+        try:
+            filepath.resolve().relative_to(resources[key].path.resolve())  # NOTE: use is_relative_to() in Python 3.9
+        except ValueError as e:
+            raise HTTPException(status_code=403, detail='forbidden') from e
         if filepath.exists():
             headers = {'Cache-Control': 'public, max-age=3600'}
             media_type, _ = mimetypes.guess_type(filepath)
             return FileResponse(filepath, media_type=media_type, headers=headers)
     raise HTTPException(status_code=404, detail=f'resource "{key}" not found')

Fixed code:         try:
            filepath.resolve().relative_to(resources[key].path.resolve())  # NOTE: use is_relative_to() in Python 3.9
        except ValueError as e:
            raise HTTPException(status_code=403, detail='forbidden') from e
CVE-2023-38699: Missing Encryption of Sensitive Data (CWE-311)
value: MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 6.5
Published: 2023-08-04T18:15Z
Repository: https://github.com/mindsdb/mindsdb
Language: Python
Files changed: mindsdb/integrations/handlers/dremio_handler/dremio_handler.py
Commit date: 2023-07-21 12:53:02 +0200
Commit message: Update dremio_handler.py
Diff: diff --git a/mindsdb/integrations/handlers/dremio_handler/dremio_handler.py b/mindsdb/integrations/handlers/dremio_handler/dremio_handler.py
index 737d6be1b..eca933a35 100644
--- a/mindsdb/integrations/handlers/dremio_handler/dremio_handler.py
+++ b/mindsdb/integrations/handlers/dremio_handler/dremio_handler.py
@@ -64,11 +64,11 @@ class DremioHandler(DatabaseHandler):
             'Content-Type': 'application/json',
         }
 
         data = '{' + f'"userName": "{self.connection_data["username"]}","password": "{self.connection_data["password"]}"' + '}'
 
-        response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data, verify=False)
+        response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data)
 
         return {
             'Authorization': '_dremio' + response.json()['token'],
             'Content-Type': 'application/json',
         }
@@ -233,6 +233,6 @@ connection_args = OrderedDict(
 connection_args_example = OrderedDict(
     host='localhost',
     database=9047,
     username='admin',
     password='password'
-)
\ No newline at end of file
+)

Vulnerable code:         response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data, verify=False)
)
Fixed code:         response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data)
)
CVE-2020-28705: Cross-Site Request Forgery (CSRF) (CWE-352)
value: FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-03-10T14:15Z
Repository: https://github.com/daylightstudio/FUEL-CMS
Language: PHP
Files changed: fuel/modules/fuel/controllers/Module.php
Commit date: 2020-11-04 20:35:31 -0800
Commit message: fix: issue #576 with expanded ability to delete pages

Diff: diff --git a/fuel/modules/fuel/controllers/Module.php b/fuel/modules/fuel/controllers/Module.php
index c1c52734..a67afe6f 100644
--- a/fuel/modules/fuel/controllers/Module.php
+++ b/fuel/modules/fuel/controllers/Module.php
@@ -1619,13 +1619,20 @@ class Module extends Fuel_base_controller {
 			show_error(lang('error_no_permissions', fuel_url()));
 		}
 
 		$inline = $this->fuel->admin->is_inline();
 
-		if ( ! empty($_POST['id']))
+		if (! empty($_POST['id']))
 		{
-			$posted = explode('|', $this->input->post('id', TRUE));
+			if (!empty($id))
+			{
+				$posted = array($id);
+			}
+			else
+			{
+				$posted = explode('|', $this->input->post('id', TRUE));
+			}
 
 			// run before_delete hook
 			$this->_run_hook('before_delete', $posted);
 
 			// Flags

Vulnerable code: 		if ( ! empty($_POST['id']))
			$posted = explode('|', $this->input->post('id', TRUE));
Fixed code: 		if (! empty($_POST['id']))
			if (!empty($id))
			{
				$posted = array($id);
			}
			else
			{
				$posted = explode('|', $this->input->post('id', TRUE));
			}
CVE-2020-15271: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-10-26T18:15Z
Repository: https://github.com/d0c-s4vage/lookatme
Language: Unknown
Commit date: 2020-10-22 22:28:53 -0700
Commit message: Merge pull request #110 from d0c-s4vage/feature/109-extension_warnings

Adds warnings about loading extensions
CVE-2024-30254: Insufficient Information (NVD-CWE-noinfo)
value: MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or `mesonlsp --full`. Version 4.1.4 contains a patch for this issue. As a workaround, avoid running `mesonlsp --full` and set the language server option `others.neverDownloadAutomatically` to `true`.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T19:15Z
Repository: https://github.com/JCWasmx86/mesonlsp
Language: Unknown
Commit date: 2024-04-01 19:03:09 +0200
Commit message: Merge branch 'fix_vuln'
CVE-2010-3844: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 8.8
Published: 2019-11-12T22:15Z
Repository: https://github.com/Ettercap/ettercap
Language: C
Files changed: src/interfaces/gtk/ec_gtk_conf.c, src/interfaces/gtk/ec_gtk_mitm.c
Commit date: 2012-08-23 09:16:28 -0400
Commit message: More changes to mitigate:
CVE-2010-3843
CVE-2010-3844

Diff: diff --git a/src/interfaces/gtk/ec_gtk_conf.c b/src/interfaces/gtk/ec_gtk_conf.c
index a1ef0c0..c1133ef 100644
--- a/src/interfaces/gtk/ec_gtk_conf.c
+++ b/src/interfaces/gtk/ec_gtk_conf.c
@@ -70,13 +70,11 @@ void gtkui_conf_read(void) {
    short value;
 
 #ifdef OS_WINDOWS
    path = ec_win_get_user_dir();
 #else
-   /* TODO: get the dopped privs home dir instead of "/root" */
-   /* path = g_get_home_dir(); */
-   path = g_get_tmp_dir();
+   path = g_get_home_dir();
 #endif
 
    filename = g_build_filename(path, ".ettercap_gtk", NULL);
 
    DEBUG_MSG("gtkui_conf_read: %s", filename);
diff --git a/src/interfaces/gtk/ec_gtk_mitm.c b/src/interfaces/gtk/ec_gtk_mitm.c
index c2efd09..23aa53e 100644
--- a/src/interfaces/gtk/ec_gtk_mitm.c
+++ b/src/interfaces/gtk/ec_gtk_mitm.c
@@ -178,13 +178,13 @@ void gtkui_icmp_redir(void)
    if(response == GTK_RESPONSE_OK) {
       gtk_widget_hide(dialog);
 
       snprintf(params, 6, "icmp:");
 
-      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), PARAMS_LEN);
-      strncat(params, "/", PARAMS_LEN);
-      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), PARAMS_LEN);
+      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), ETH_ASCII_ADDR_LEN);
+      strncat(params, "/", 1);
+      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), IP6_ASCII_ADDR_LEN);
 
       gtkui_start_mitm();
    }
 
    gtk_widget_destroy(dialog);

Vulnerable code:    /* TODO: get the dopped privs home dir instead of "/root" */
   /* path = g_get_home_dir(); */
   path = g_get_tmp_dir();
      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), PARAMS_LEN);
      strncat(params, "/", PARAMS_LEN);
      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), PARAMS_LEN);
Fixed code:    path = g_get_home_dir();
      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry1)), ETH_ASCII_ADDR_LEN);
      strncat(params, "/", 1);
      strncat(params, gtk_entry_get_text(GTK_ENTRY(entry2)), IP6_ASCII_ADDR_LEN);
CVE-2014-6395: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-12-19T15:59Z
Repository: https://github.com/Ettercap/ettercap
Language: C
Files changed: src/dissectors/ec_postgresql.c
Commit date: 2014-09-09 09:13:04 +0200
Commit message: Fixed heap overflow caused by length

Diff: diff --git a/src/dissectors/ec_postgresql.c b/src/dissectors/ec_postgresql.c
index fa267416..95bf5527 100644
--- a/src/dissectors/ec_postgresql.c
+++ b/src/dissectors/ec_postgresql.c
@@ -37,11 +37,11 @@
 
 struct postgresql_status {
    u_char status;
    u_char user[65];
    u_char type;
-   u_char password[65];
+   u_char password[66];
    u_char hash[33];
    u_char salt[9];
    u_char database[65];
 };
 
@@ -155,12 +155,16 @@ FUNC_DECODER(dissector_postgresql)
             }
             else if (ptr[0] == 'p' && conn_status->type == CT) {
                int length;
                DEBUG_MSG("\tDissector_postgresql RESPONSE type is clear-text!");
                GET_ULONG_BE(length, ptr, 1);
-               strncpy((char*)conn_status->password, (char*)(ptr + 5), length - 4);
-               conn_status->password[length - 4] = 0;
+               length -= 4;
+               if (length < 0 || length > 65 || PACKET->DATA.len < length+5) {
+                   dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
+                   return NULL;
+               }
+               snprintf((char*)conn_status->password, length+1, "%s", (char*)(ptr + 5));
                DISSECT_MSG("PostgreSQL credentials:%s-%d:%s:%s\n", ip_addr_ntoa(&PACKET->L3.dst, tmp), ntohs(PACKET->L4.dst), conn_status->user, conn_status->password);
                dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
             }
          }
       }

Vulnerable code:    u_char password[65];
               strncpy((char*)conn_status->password, (char*)(ptr + 5), length - 4);
               conn_status->password[length - 4] = 0;
Fixed code:    u_char password[66];
               length -= 4;
               if (length < 0 || length > 65 || PACKET->DATA.len < length+5) {
                   dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
                   return NULL;
               }
               snprintf((char*)conn_status->password, length+1, "%s", (char*)(ptr + 5));
CVE-2014-6396: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-12-19T15:59Z
Repository: https://github.com/Ettercap/ettercap
Language: C
Files changed: src/dissectors/ec_postgresql.c
Commit date: 2014-09-09 09:13:04 +0200
Commit message: Fixed heap overflow caused by length

Diff: diff --git a/src/dissectors/ec_postgresql.c b/src/dissectors/ec_postgresql.c
index fa267416..95bf5527 100644
--- a/src/dissectors/ec_postgresql.c
+++ b/src/dissectors/ec_postgresql.c
@@ -37,11 +37,11 @@
 
 struct postgresql_status {
    u_char status;
    u_char user[65];
    u_char type;
-   u_char password[65];
+   u_char password[66];
    u_char hash[33];
    u_char salt[9];
    u_char database[65];
 };
 
@@ -155,12 +155,16 @@ FUNC_DECODER(dissector_postgresql)
             }
             else if (ptr[0] == 'p' && conn_status->type == CT) {
                int length;
                DEBUG_MSG("\tDissector_postgresql RESPONSE type is clear-text!");
                GET_ULONG_BE(length, ptr, 1);
-               strncpy((char*)conn_status->password, (char*)(ptr + 5), length - 4);
-               conn_status->password[length - 4] = 0;
+               length -= 4;
+               if (length < 0 || length > 65 || PACKET->DATA.len < length+5) {
+                   dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
+                   return NULL;
+               }
+               snprintf((char*)conn_status->password, length+1, "%s", (char*)(ptr + 5));
                DISSECT_MSG("PostgreSQL credentials:%s-%d:%s:%s\n", ip_addr_ntoa(&PACKET->L3.dst, tmp), ntohs(PACKET->L4.dst), conn_status->user, conn_status->password);
                dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
             }
          }
       }

Vulnerable code:    u_char password[65];
               strncpy((char*)conn_status->password, (char*)(ptr + 5), length - 4);
               conn_status->password[length - 4] = 0;
Fixed code:    u_char password[66];
               length -= 4;
               if (length < 0 || length > 65 || PACKET->DATA.len < length+5) {
                   dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
                   return NULL;
               }
               snprintf((char*)conn_status->password, length+1, "%s", (char*)(ptr + 5));
CVE-2023-3620: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-07-11T15:15Z
Repository: https://github.com/amauric/tarteaucitron.js
Language: JavaScript
Files changed: tarteaucitron.js
Commit date: 2023-07-11 16:51:14 +0200
Commit message: Filter the attr to avoid possible XSS vulnerability Fix #1132

Diff: diff --git a/tarteaucitron.js b/tarteaucitron.js
index e4421ce..2c3b0c1 100644
--- a/tarteaucitron.js
+++ b/tarteaucitron.js
@@ -2081,11 +2081,17 @@ var tarteaucitron = {
     },
     "getElemHeight": function(elem) {
         return elem.getAttribute('height') || elem.clientHeight;
     },
     "getElemAttr": function (elem, attr) {
-        return elem.getAttribute('data-' + attr) || elem.getAttribute(attr);
+        var attribute = elem.getAttribute('data-' + attr) || elem.getAttribute(attr);
+
+        if (typeof attribute === 'string') {
+            return tarteaucitron.fixSelfXSS(attribute);
+        }
+
+        return "";
     },
     "addClickEventToId": function (elemId, func) {
         tarteaucitron.addClickEventToElement(document.getElementById(elemId), func);
     },
     "addClickEventToElement": function (e, func) {

Vulnerable code:         return elem.getAttribute('data-' + attr) || elem.getAttribute(attr);
Fixed code:         var attribute = elem.getAttribute('data-' + attr) || elem.getAttribute(attr);

        if (typeof attribute === 'string') {
            return tarteaucitron.fixSelfXSS(attribute);
        }

        return "";
CVE-2014-125084: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-06T00:15Z
Repository: https://github.com/gimmie/vbulletin-v4
Language: PHP
Files changed: Upload/plugins/gimmie/trigger_referral.php
Commit date: 2014-09-08 17:14:27 +0800
Commit message: Update trigger_referral.php to prevent SQL Injection
Diff: diff --git a/Upload/plugins/gimmie/trigger_referral.php b/Upload/plugins/gimmie/trigger_referral.php
index 6db82e1..3bd008c 100644
--- a/Upload/plugins/gimmie/trigger_referral.php
+++ b/Upload/plugins/gimmie/trigger_referral.php
@@ -1,10 +1,10 @@
 <?php
 require_once(DIR . '/plugins/gimmie/functions.php');
 require_once(DIR . '/plugins/gimmie/OAuth.php');
 
-$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = '" . $_POST['referrername'] . "'");
+$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = " . $vbulletin->db->escape_string($_POST['referrername']));
 $user   = $vbulletin->db->fetch_array($usersql);
 
 $my_player_uid        = $user['email'];
 
 $key            = $gimmie['gimmie_key']; 
@@ -26,6 +26,6 @@ if (!empty($user['userid']) && $vbulletin->options['gimmie_enable_global'] == 1
 
   fetch_web_data($acc_req->to_url());
   return;
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code: $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = '" . $_POST['referrername'] . "'");
?>
Fixed code: $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = " . $vbulletin->db->escape_string($_POST['referrername']));
?>
CVE-2014-125086: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file trigger_login.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is named fe851002d20a8d6196a5abb68bafec4102964d5b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220207.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-06T04:15Z
Repository: https://github.com/gimmie/vbulletin-v4
Language: PHP
Files changed: Upload/plugins/gimmie/trigger_login.php
Commit date: 2014-09-08 17:11:53 +0800
Commit message: Update trigger_login.php to prevent SQL injection
Diff: diff --git a/Upload/plugins/gimmie/trigger_login.php b/Upload/plugins/gimmie/trigger_login.php
index 152e5ef..5753dfa 100644
--- a/Upload/plugins/gimmie/trigger_login.php
+++ b/Upload/plugins/gimmie/trigger_login.php
@@ -1,10 +1,10 @@
 <?php
 require_once(DIR . '/plugins/gimmie/functions.php');
 require_once(DIR . '/plugins/gimmie/OAuth.php');
 
-$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = '" . $vbulletin->userinfo['userid'] . "'");
+$usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = " . $vbulletin->db->escape_string($vbulletin->userinfo['userid']));
 
 $user   = $vbulletin->db->fetch_array($usersql);
 
 $my_player_uid        = $user['email'];
 
@@ -27,6 +27,6 @@ $acc_req->sign_request($sig_method, $consumer, $token);
 fetch_web_data($acc_req->to_url());
 return;
 
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code: $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = '" . $vbulletin->userinfo['userid'] . "'");
?>
Fixed code: $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `userid` = " . $vbulletin->db->escape_string($vbulletin->userinfo['userid']));
?>
CVE-2023-26042: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-27T15:15Z
Repository: https://github.com/Part-DB/Part-DB-server
Language: Unknown
Commit date: 2023-02-25 23:47:48 +0100
Commit message: Merge pull request #225 from sascha988/patch-2

vulnerability XSS fix
CVE-2015-0856: Permissions, Privileges, and Access Controls (CWE-264)
value: daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2015-11-24T20:59Z
Repository: https://github.com/sddm/sddm
Language: C++
Files changed: src/daemon/Greeter.cpp
Commit date: 2015-10-14 14:00:26 +0100
Commit message: Disable greeters from loading KDE's debug hander

Some themes may use KDE components which will automatically load KDE's
crash handler.

If the greeter were to then somehow crash, that would leave a crash
handler allowing other actions, albeit as the locked down SDDM user.

Only SDDM users using the breeze theme from plasma-workspace are
affected. Safest and simplest fix is to handle this inside SDDM
disabling kcrash via an environment variable for all future themes that
may use these libraries.

CVE-2015-0856

Diff: diff --git a/src/daemon/Greeter.cpp b/src/daemon/Greeter.cpp
index 68c4dc3..8c936b7 100644
--- a/src/daemon/Greeter.cpp
+++ b/src/daemon/Greeter.cpp
@@ -143,10 +143,14 @@ namespace SDDM {
             env.insert(QStringLiteral("XDG_SEAT_PATH"), daemonApp->displayManager()->seatPath(m_display->seat()->name()));
             env.insert(QStringLiteral("XDG_SESSION_PATH"), daemonApp->displayManager()->sessionPath(QStringLiteral("Session%1").arg(daemonApp->newSessionId())));
             env.insert(QStringLiteral("XDG_VTNR"), QString::number(m_display->terminalId()));
             env.insert(QStringLiteral("XDG_SESSION_CLASS"), QStringLiteral("greeter"));
             env.insert(QStringLiteral("XDG_SESSION_TYPE"), m_display->sessionType());
+
+            //some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
+            //counterintuitively setting this env disables that handler
+            env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
             m_auth->insertEnvironment(env);
 
             // log message
             qDebug() << "Greeter starting...";
 

Fixed code: 
            //some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
            //counterintuitively setting this env disables that handler
            env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
CVE-2018-14345: Improper Authentication (CWE-287)
value: An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2018-07-17T14:29Z
Repository: https://github.com/sddm/sddm
Language: C++
Files changed: src/daemon/Display.cpp, src/helper/backend/PamBackend.cpp
Commit date: 2018-07-17 13:09:58 +0200
Commit message: Fix authentication when reusing an existing session

- Check the success value before unlocking the session
- Don't attempt to use the nonexistant "sddm-check" PAM service

Diff: diff --git a/src/daemon/Display.cpp b/src/daemon/Display.cpp
index 5abfc9a..57d7ecb 100644
--- a/src/daemon/Display.cpp
+++ b/src/daemon/Display.cpp
@@ -337,11 +337,13 @@ namespace SDDM {
         if (existingSessionId.isNull()) {
             m_auth->setSession(session.exec());
         } else {
             //we only want to unlock the session if we can lock in, so we want to go via PAM auth, but not start a new session
             //by not setting the session and the helper will emit authentication and then quit
-            connect(m_auth, &Auth::authentication, this, [=](){
+            connect(m_auth, &Auth::authentication, this, [=](const QString &, bool success){
+                if(!success)
+                    return;
                 qDebug() << "activating existing seat";
                 OrgFreedesktopLogin1ManagerInterface manager(Logind::serviceName(), Logind::managerPath(), QDBusConnection::systemBus());
                 manager.UnlockSession(existingSessionId);
                 manager.ActivateSession(existingSessionId);
             });
diff --git a/src/helper/backend/PamBackend.cpp b/src/helper/backend/PamBackend.cpp
index 69cbd2c..5467282 100644
--- a/src/helper/backend/PamBackend.cpp
+++ b/src/helper/backend/PamBackend.cpp
@@ -217,12 +217,10 @@ namespace SDDM {
 
         QString service = QStringLiteral("sddm");
 
         if (user == QStringLiteral("sddm") && m_greeter)
             service = QStringLiteral("sddm-greeter");
-        else if (m_app->session()->path().isEmpty())
-            service = QStringLiteral("sddm-check");
         else if (m_autologin)
             service = QStringLiteral("sddm-autologin");
         result = m_pam->start(service, user);
 
         if (!result)

Vulnerable code:             connect(m_auth, &Auth::authentication, this, [=](){
        else if (m_app->session()->path().isEmpty())
            service = QStringLiteral("sddm-check");
Fixed code:             connect(m_auth, &Auth::authentication, this, [=](const QString &, bool success){
                if(!success)
                    return;