hitoshura25/cvefixes huggingface dataset:
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/lanlinkprovider.cpp
Commit message: Do not let lanlink connections stay open for long without authenticating

If there's no information received, close the socket to try again.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:

Fixed code:
        QTimer* timer = new QTimer(socket);
        timer->setSingleShot(true);
        timer->setInterval(1000);
        connect(socket, &QSslSocket::encrypted,
                timer, &QObject::deleteLater);
        connect(timer, &QTimer::timeout, socket, [socket] {
            qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Host timed out without sending any identity." << socket->peerAddress();
            socket->disconnectFromHost();
        });
        timer->start();
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/lanlinkprovider.cpp
Commit message: Limit number of connected sockets from unpaired devices

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:

Fixed code:
static const int MAX_UNPAIRED_CONNECTIONS = 42;

        // Socket disconnection will now be handled by LanDeviceLink
        disconnect(socket, &QAbstractSocket::disconnected, socket, &QObject::deleteLater);
        bool isDeviceTrusted = KdeConnectConfig::instance().trustedDevices().contains(deviceId);
        if (!isDeviceTrusted && m_links.size() > MAX_UNPAIRED_CONNECTIONS) {
            qCWarning(KDECONNECT_CORE) << "Too many unpaired devices to remember them all. Ignoring " << deviceId;
            socket->disconnectFromHost();
            socket->deleteLater();
            return;
        }
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/lanlinkprovider.cpp
Commit message: Do not remember more than a few identity packets at a time

To prevent the kdeconnect process from using too much memory.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:

Fixed code:
static const int MAX_REMEMBERED_IDENTITY_PACKETS = 42;
        if (m_receivedIdentityPackets.size() > MAX_REMEMBERED_IDENTITY_PACKETS) {
            qCWarning(KDECONNECT_CORE) << "Too many remembered identities, ignoring" << receivedPacket->get<QString>(QStringLiteral("deviceId")) << "received via UDP";
            delete receivedPacket;
            continue;
        }

    if (m_receivedIdentityPackets.size() > MAX_REMEMBERED_IDENTITY_PACKETS) {
        qCWarning(KDECONNECT_CORE) << "Too many remembered identities, ignoring" << np->get<QString>(QStringLiteral("deviceId")) << "received via TCP";
        delete np;
        return;
    }
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/lanlinkprovider.cpp
Commit message: Limit identity packets to 8KiB

Healthy identity packages shouldn't be that big and we don't want to
allow systems around us to send us ever humongous packages that will
just leave us without any memory.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:

Fixed code:
    //the size here is arbitrary and is now at 8192 bytes. It needs to be considerably long as it includes the capabilities but there needs to be a limit
    //Tested between my systems and I get around 2000 per identity package.
    if (socket->bytesAvailable() > 8192) {
        qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Suspiciously long identity package received. Closing connection." << socket->peerAddress() << socket->bytesAvailable();
        socket->disconnectFromHost();
        return;
    }
CVE-2020-26164 (C++, published 2020-10-07T19:15Z)
Description: value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/KDE/kdeconnect-kde
Files changed:
core/backends/lan/lanlinkprovider.cpp
Commit message: Limit the ports we try to connect to to the port range of KDE Connect

So we can't trigger connections to other services.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.


Vulnerable code:

Fixed code:
        if (tcpPort < MIN_TCP_PORT || tcpPort > MAX_TCP_PORT) {
            qCDebug(KDECONNECT_CORE) << "TCP port outside of kdeconnect's range";
            delete receivedPacket;
            continue;
        }
CVE-2017-9454 (C, published 2017-08-18T14:29Z)
Description: value: Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/resiprocate/resiprocate
Files changed:
rutil/dns/ares/ares_parse_a_reply.c
Commit message: ares: Prevent buffer overlow in ares_parse_a_reply (CVE-2017-9454)

This buffer overflow is in the embedded copy of ares that will be
used unless the external alternative c-ares is used by specifying
the configure argument --with-c-ares.

It has been found with LibFuzzer from the LLVM project.


Vulnerable code:

Fixed code:
      if (aptr + rr_len > abuf + alen)
	{
	  free(rr_name);
	  status = ARES_EBADRESP;
	  break;
	}
CVE-2018-12584 (Other, published 2018-07-16T20:29Z)
Description: value: The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of service (buffer overflow) or possibly execute arbitrary code when TLS communication is enabled.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/resiprocate/resiprocate
Files changed:
resip/stack/ConnectionBase.cxx
Commit message: -fixed an issue where the stack could crash if a TCP based sender sends a Content-Length that is less that the actual SIP body transmitted
 in order to trigger this condition the SIP message body must arrive in a separate read request, either from the start or part way through the body
 and there must be data following the body in the same read.


Vulnerable code:
                  DebugLog (<< Data(mBuffer, overHang));
         if (mBufferPos == contentLength)
            mBuffer=0;
            mConnState = NewMessage;
            // .bwc. We've filled our buffer; go ahead and make more room.

Fixed code:
                  //DebugLog (<< Data(mBuffer, overHang));
         if (mBufferPos >= contentLength)
            int overHang = mBufferPos - (int)contentLength;
            char *overHangStart = mBuffer + contentLength;

            mConnState = NewMessage;
            mBuffer = 0;

            if (overHang > 0)
            {
                // The next message has been partially read.
                size_t size = overHang * 3 / 2;
                if (size < ConnectionBase::ChunkSize)
                {
                    size = ConnectionBase::ChunkSize;
                }
                char* newBuffer = MsgHeaderScanner::allocateBuffer((int)size);
                memcpy(newBuffer, overHangStart, overHang);
                mBuffer = newBuffer;
                mBufferPos = 0;
                mBufferSize = size;

                DebugLog(<< "Extra bytes after message: " << overHang);
                //DebugLog(<< Data(mBuffer, overHang));

                bytesRead = overHang;
            }

            
            if (overHang > 0) 
            {
               goto start;
            }
            // .bwc. We've filled our buffer and haven't read contentLength bytes yet; go ahead and make more room.
            assert(contentLength >= mBufferSize);
CVE-2023-38997 (Python, published 2023-08-09T19:15Z)
Description: value: A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
Commit message: Services: Captive Portal - safeguard template overlay distribution.


Vulnerable code:
    template_data = cnf.fetch_template_data(sys.argv[1])
                if zf_info.filename[-1] != '/':
                    target_filename = '%s%s' % (target_directory, zf_info.filename)

Fixed code:
    template_data = cnf.fetch_template_data(zoneid)
                target_filename = '%s%s' % (target_directory, zf_info.filename)
                if os.path.realpath(target_filename).startswith(target_directory):
CVE-2023-38998 (Other, published 2023-08-09T19:15Z)
Description: value: An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/opnsense/core
Files changed:
src/etc/inc/authgui.inc
Commit message: login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete

(bugfix https://github.com/opnsense/core/commit/3c2f32ec8dd1fb0da72e677b40163527fdaec7da)


Vulnerable code:
                    $redir_uri = $tmp_url_parts['path'];

Fixed code:
                    $redir_uri = sprintf(
                        '%s://%s/%s',
                        isset($_SERVER['HTTPS']) ? 'https' : 'http',
                        $_SERVER['HTTP_HOST'],
                        ltrim($tmp_url_parts['path'], '/')
                    );
CVE-2023-38999 (PHP, published 2023-08-09T19:15Z)
Description: value: A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php
Commit message: Power - do not allow state modification on GET for halt and reboot


Vulnerable code:
        $backend = new Backend();
        $backend->configdRun('system halt', true);
        return [
            'status' => 'ok'
        ];
        $backend = new Backend();
        $backend->configdRun('system reboot', true);
        return [
            'status' => 'ok'
        ];

Fixed code:
        if ($this->request->isPost()) {
            (new Backend())->configdRun('system halt', true);
            return ['status' => 'ok'];
        } else {
            return ['status' => 'failed'];
        }
        if ($this->request->isPost()) {
            (new Backend())->configdRun('system reboot', true);
            return ['status' => 'ok'];
        } else {
            return ['status' => 'failed'];
        }
CVE-2023-39000 (PHP, published 2023-08-09T19:15Z)
Description: value: A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
Commit message: System:Logging - Sanitize user input. An alfanum filter might be possible as well to strip module and scope, but might break some external plugins not on our radar.


Vulnerable code:
        $this->view->module = $module;
        $this->view->scope = $scope;

Fixed code:
        $this->view->module = htmlspecialchars($module, ENT_QUOTES | ENT_HTML401);
        $this->view->scope = htmlspecialchars($scope, ENT_QUOTES | ENT_HTML401);
CVE-2023-39001 (Other, published 2023-08-09T19:15Z)
Description: value: A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/service/templates/OPNsense/Cron/user.cron
Commit message: System/Settings/Cron  - improve escaping in /var/cron/tabs/nobody generation.


Vulnerable code:
{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%

Fixed code:
{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
CVE-2023-39002 (PHP, published 2023-08-09T19:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/www/system_camanager.php
src/www/system_certmanager.php
Commit message: System: Trust: Authorities - Sanitize $act parameter


Vulnerable code:

Fixed code:
$act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
$act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
CVE-2023-39006 (PHP, published 2023-08-09T19:15Z)
Description: value: The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/www/crash_reporter.php
Commit message: System: Firmware: Reporter - escape reports


Vulnerable code:
                    <pre><?=$content;?></pre>

Fixed code:
                    <pre><?=html_safe($content);?></pre>
CVE-2023-39007 (PHP, published 2023-08-09T19:15Z)
Description: value: /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
Commit message: System:Settings:Cron - cleanse user input in /ui/cron/item/open/...


Vulnerable code:
        $this->view->selected_uuid = $uuid;

Fixed code:
        $this->view->selected_uuid = htmlspecialchars($uuid, ENT_QUOTES | ENT_HTML401);
CVE-2023-39008 (Other, published 2023-08-09T19:15Z)
Description: value: A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/opnsense/core
Files changed:
src/opnsense/service/templates/OPNsense/Cron/user.cron
Commit message: System/Settings/Cron  - improve escaping in /var/cron/tabs/nobody generation.


Vulnerable code:
{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%

Fixed code:
{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
CVE-2023-44275 (PHP, published 2023-09-28T05:15Z)
Description: value: OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/www/index.php
Commit message: Lobby: Dashboard - fix data cleansing issue in column_count and sequences.


Vulnerable code:
        $config['widgets']['column_count'] = $_POST['column_count'];

Fixed code:
    legacy_html_escape_form_data($pconfig);
        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);
CVE-2023-44276 (PHP, published 2023-09-28T05:15Z)
Description: value: OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opnsense/core
Files changed:
src/www/index.php
Commit message: Lobby: Dashboard - fix data cleansing issue in column_count and sequences.


Vulnerable code:
        $config['widgets']['column_count'] = $_POST['column_count'];

Fixed code:
    legacy_html_escape_form_data($pconfig);
        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);