hitoshura25/cvefixes huggingface dataset:
CVE-2022-39265 (PHP, published 2022-10-06T18:16Z)
Description: value: MyBB is a free and open source forum software. The _Mail Settings_ ? Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/mybb/mybb
Files changed:
inc/functions.php
install/resources/settings.xml
Commit message: Fix Mail settings command parameter injection


Vulnerable code:
				if(!empty($mybb->settings['mail_parameters']))
					$my_mailhandler_builtin->additional_parameters = $mybb->settings['mail_parameters'];
			<description><![CDATA[This setting allows you to set additional parameters for the PHP mail() function. Only used when 'PHP mail' is selected as Mail Handler. <a href="http://php.net/function.mail" target="_blank" rel="noopener">More information</a>]]></description>

Fixed code:
				if(!empty($mybb->config['mail_parameters']))
					$my_mailhandler_builtin->additional_parameters = $mybb->config['mail_parameters'];
			<description><![CDATA[<strong>Not supported.</strong> Additional parameters can be set in the <a href="https://docs.mybb.com/1.8/faq/mail/#additional-parameters-for-phps-mail">Configuration File</a> instead.]]></description>
CVE-2023-41362 (PHP, published 2023-08-29T16:15Z)
Description: value: MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/mybb/mybb
Files changed:
admin/inc/functions.php
Commit message: Fix ACP Templates RCE


Vulnerable code:
	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template)) 
	if(preg_match('#\$\s*\{#', $template))
	if(preg_match("~\\{\\$.+?\\}~s", preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template)))

Fixed code:
	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template) !== 0)
	if(preg_match('#\$\s*\{#', $template) !== 0)
	$allowed = preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template);
	if($allowed === null || preg_match("~\\{\\$.+?\\}~s", $allowed) !== 0)
CVE-2024-23335 (PHP, published 2024-05-01T07:15Z)
Description: value: MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mybb/mybb
Files changed:
admin/modules/tools/backupdb.php
Commit message: Fix backups directory .htaccess deletion


Vulnerable code:
	if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file))

Fixed code:
    $ext = get_extension($file);
    if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file) || filetype(MYBB_ADMIN_DIR.'backups/'.$file) != 'file' || ($ext != 'gz' && $ext != 'sql'))
CVE-2024-23336 (PHP, published 2024-05-01T07:15Z)
Description: value: MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mybb/mybb
Files changed:
install/index.php
Commit message: Fix incomplete disallowed remote addresses list SSRF


Vulnerable code:
	'127.0.0.1',

Fixed code:
	'0.0.0.0',
	'127.0.0.0/8',
CVE-2020-36645 (Unknown, published 2023-01-07T19:15Z)
Description: value: A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/square/squalor
Files changed:
Commit message: Merge pull request #76 from danrice-square/fix_sql_injection

Prevent a SQL injection

Vulnerable code:

Fixed code:
CVE-2023-48713 (Go, published 2023-11-28T04:15Z)
Description: value: Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/knative/serving
Files changed:
pkg/autoscaler/metrics/http_scrape_client.go
pkg/autoscaler/metrics/http_scrape_client_test.go
Commit message: Bound buffer for reading stats (#14523)



Vulnerable code:
	_, err := b.ReadFrom(body)

Fixed code:
	// 6 8-byte fields (+2 bytes marshalling), one hostname, 20 bytes extra space
	r := io.LimitedReader{R: body, N: 6*10 + 256 + 20}
	_, err := b.ReadFrom(&r)
	}, {
		name:         "LongStat",
		responseCode: http.StatusOK,
		responseType: "application/protobuf",
		stat: Stat{
			// We don't expect PodName to be 600 characters long
			PodName:                          strings.Repeat("a123456789", 60),
			AverageConcurrentRequests:        1.1,
			AverageProxiedConcurrentRequests: 1.1,
			RequestCount:                     33.2,
			ProxiedRequestCount:              33.2,
			ProcessUptime:                    12345.678,
			Timestamp:                        1697431278,
		},
		expectedErr: "unmarshalling failed: unexpected EOF",
CVE-2021-23363 (JavaScript, published 2021-03-30T15:15Z)
Description: value: This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/GuyMograbi/kill-by-port
Files changed:
index.js
Commit message: fix kill by port


Vulnerable code:
    processId = exec(`lsof -t -i:${port}`)

Fixed code:
    processId = exec(`lsof -t -i:${parseInt(port, 10)}`)
CVE-2017-14064 (C, published 2017-08-31T17:29Z)
Description: value: Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/flori/json
Files changed:
ext/json/ext/generator/generator.c
ext/json/ext/generator/generator.h
Commit message: Fix arbitrary heap exposure problem


Vulnerable code:
  memccpy(result, ptr, 0, len);
        state->indent = strdup(RSTRING_PTR(indent));
        state->space = strdup(RSTRING_PTR(space));
        state->space_before = strdup(RSTRING_PTR(space_before));
        state->object_nl = strdup(RSTRING_PTR(object_nl));
        state->array_nl = strdup(RSTRING_PTR(array_nl));
#include <string.h>

Fixed code:
  memcpy(result, ptr, len);
        state->indent = fstrndup(RSTRING_PTR(indent), len);
        state->space = fstrndup(RSTRING_PTR(space), len);
        state->space_before = fstrndup(RSTRING_PTR(space_before), len);
        state->object_nl = fstrndup(RSTRING_PTR(object_nl), len);
        state->array_nl = fstrndup(RSTRING_PTR(array_nl), len);
CVE-2022-24884 (C, published 2022-05-06T00:15Z)
Description: value: ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/freifunk-gluon/ecdsautils
Files changed:
src/lib/ecdsa.c
Commit message: verify: fix signature verification (CVE-2022-24884)

Verify that r and s are non-zero. Without these checks, an all-zero
signature is always considered valid.

While it would be nicer to error out in ecdsa_verify_prepare_legacy()
already, that would require users of libecdsautil to check a return value
of the prepare step. To be safe, implement the fix in an API/ABI-compatible
way that doesn't need changes to the users.


Vulnerable code:

Fixed code:
  if (ecc_25519_gf_is_zero(&signature->s) || ecc_25519_gf_is_zero(&signature->r)) {
    // Signature is invalid, mark by setting ctx->r to an invalid value
    memset(&ctx->r, 0, sizeof(ctx->r));
    return;
  }

  // Signature was detected as invalid in prepare step
  if (ecc_25519_gf_is_zero(&ctx->r))
    return false;
CVE-2022-24884 (Unknown, published 2022-05-06T00:15Z)
Description: value: ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/freifunk-gluon/ecdsautils
Files changed:
Commit message: Merge pull request from GHSA-qhcg-9ffp-78pw

verify: fix signature verification (CVE-2022-24884)

Vulnerable code:

Fixed code:
CVE-2015-20110 (Unknown, published 2023-10-31T03:15Z)
Description: value: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/jhipster/generator-jhipster
Files changed:
Commit message: Merge pull request #2096 from maklemenz/tokenprovider-timingattack

fixed timing attack vulnerability in TokenProvider

Vulnerable code:

Fixed code:
CVE-2015-20110 (Java, published 2023-10-31T03:15Z)
Description: value: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/jhipster/generator-jhipster
Files changed:
app/templates/src/main/java/package/security/xauth/_TokenProvider.java
Commit message: fixed timing attack vulnerability in TokenProvider #2095


Vulnerable code:
        return expires >= System.currentTimeMillis() && signature.equals(signatureToMatch);

Fixed code:
        return expires >= System.currentTimeMillis() && constantTimeEquals(signature, signatureToMatch));

    /**
     * String comparison that doesn't stop at the first character that is different but instead always
     * iterates the whole string length to prevent timing attacks.
     */
    private boolean constantTimeEquals(String a, String b) {
        if (a.length() != b.length()) {
            return false;
        } else {
            int equal = 0;
            for (int i = 0; i < a.length(); i++) {
                equal |= a.charAt(i) ^ b.charAt(i);
            }
            return equal == 0;
        }
    }
CVE-2024-39901 (Markdown, published 2024-07-09T22:15Z)
Description: value: OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/opensearch-project/observability
Files changed:
DEVELOPER_GUIDE.md
README.md
src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt
Commit message: tenancy access control (#1821) (#1822)

* Check user name for private tenant access control



* fix broken link



* remove broken link



---------


(cherry picked from commit de183277b3c8782373eb520e6c4018eb55d3c119)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Vulnerable code:
1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) from [opensearch.org](https://opensearch.org/downloads.html).
1. Download the OpenSearch Dashboards source code for the [version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) you want to set up.
[cypress-code-link]: https://github.com/opensearch-project/observability/blob/main/dashboards-observability/.cypress/CYPRESS_TESTS.md
[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/opensearch-observability/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt

Fixed code:
1. Download OpenSearch for the version that matches the OpenSearch Dashboards version specified in `opensearch_dashboards.json` from [opensearch.org](https://opensearch.org/downloads.html).
1. Download the OpenSearch Dashboards source code for the version specified in `opensearch_dashboards.json` you want to set up.
[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
        if (isUserPrivateTenant(user)) {
            return access.contains("$USER_TAG${user.name}")
        }
CVE-2020-11080 (C, published 2020-06-03T23:15Z)
Description: value: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/nghttp2/nghttp2
Files changed:
lib/nghttp2_session.c
Commit message: Earlier check for settings flood


Vulnerable code:

Fixed code:
        /* Check the settings flood counter early to be safe */
        if (session->obq_flood_counter_ >= session->max_outbound_ack &&
            !(iframe->frame.hd.flags & NGHTTP2_FLAG_ACK)) {
          return NGHTTP2_ERR_FLOODED;
        }
CVE-2024-28182 (C, published 2024-04-04T15:15Z)
Description: value: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nghttp2/nghttp2
Files changed:
lib/includes/nghttp2/nghttp2.h
lib/nghttp2_helper.c
lib/nghttp2_session.c
lib/nghttp2_session.h
Commit message: Limit CONTINUATION frames following an incoming HEADER frame


Vulnerable code:
  NGHTTP2_ERR_FLOODED = -904

Fixed code:
  NGHTTP2_ERR_FLOODED = -904,
  /**
   * When a local endpoint receives too many CONTINUATION frames
   * following a HEADER frame.
   */
  NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905,
  case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS:
    return "Too many CONTINUATION frames following a HEADER frame";
  (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS;

        session->num_continuations = 0;
      if (++session->num_continuations > session->max_continuations) {
        return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS;
      }

/* The default max number of CONTINUATION frames following an incoming
   HEADER frame. */
#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8

  /* The maximum number of CONTINUATION frames following an incoming
     HEADER frame. */
  size_t max_continuations;
  /* The number of CONTINUATION frames following an incoming HEADER
     frame.  This variable is reset when END_HEADERS flag is seen. */
  size_t num_continuations;