hitoshura25/cvefixes huggingface dataset:
CVE-2024-29031 (Unknown, published 2024-03-21T23:15Z)
Description: value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/meshery/meshery
Files changed:
Commit message: Merge pull request #10207 from gyohuangxin/fix_sql_injection

Fix SQL injection in /api/system/meshsync/resources

Vulnerable code:

Fixed code:
CVE-2024-35181 (Unknown, published 2024-05-27T19:15Z)
Description: value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/meshery/meshery
Files changed:
Commit message: Merge pull request #10207 from gyohuangxin/fix_sql_injection

Fix SQL injection in /api/system/meshsync/resources

Vulnerable code:

Fixed code:
CVE-2024-35181 (Unknown, published 2024-05-27T19:15Z)
Description: value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/meshery/meshery
Files changed:
Commit message: Merge pull request #10280 from gyohuangxin/fix_sql_injection_2

Fix more SQL injections

Vulnerable code:

Fixed code:
CVE-2024-35182 (Unknown, published 2024-05-27T19:15Z)
Description: value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/meshery/meshery
Files changed:
Commit message: Merge pull request #10280 from gyohuangxin/fix_sql_injection_2

Fix more SQL injections

Vulnerable code:

Fixed code:
CVE-2021-4303 (PHP, published 2023-01-05T09:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 3.0.0 is able to address this issue. The patch is identified as 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/shannah/xataface
Files changed:
install/install_form.js.php
Commit message: Fixed XSS vulnerability reported by hitisec.  This is low threat since it is in the installer, which is disabled by default, and should only be enabled temporarily by trusted parties.  E.g. in order to even reach the vulnerability, the user would need to have a valid username/password for the MySQL database.


Vulnerable code:
		eval('var results = '+result+';');
		resultDiv.innerHTML = results.message;
		var resultDiv = document.getElementById('db-test-results');
		eval('var results = '+result+';');
		resultDiv.innerHTML = results.message;

Fixed code:
		var results = JSON.parse(result);
		resultDiv.innerText = results.message;
        var results = JSON.parse(result);
		resultDiv.innerText = results.message;
CVE-2017-1000458 (C++, published 2018-01-02T18:29Z)
Description: value: Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bro/bro
Files changed:
src/analyzer/protocol/tcp/ContentLine.cc
Commit message: Patch OOB write in content-line analyzer.

A combination of packets can trigger an out of bound write of '0' byte
in the content-line analyzer.

This bug was found by Frank Meier.

Addresses BIT-1856.


Vulnerable code:

Fixed code:
				// Weird corner-case:
				// this can happen if we see a \r at the end of a packet where crlf is
				// set to CR_as_EOL | LF_as_EOL, with the packet causing crlf to be set to
				// 0 and the next packet beginning with a \n. In this case we just swallow
				// the character and re-set last_char.
				if ( offset == 0 )
					{
					last_char = c;
					break;
					}
CVE-2018-16807 (Other, published 2018-09-11T02:29Z)
Description: value: In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/bro/bro
Files changed:
scripts/base/protocols/krb/main.bro
testing/btest/core/leaks/krb-service-name.test
Commit message: Fix potential memory leak in Kerberos scripts

Reported by Maksim Shudrak.


Vulnerable code:
	c$krb$service      = msg$service_name;
	c$krb$service = msg$service_name;

Fixed code:
	if ( msg?$service_name )
		c$krb$service      = msg$service_name;
	if ( msg?$service_name )
		c$krb$service = msg$service_name;
# Needs perftools support.
#
# @TEST-REQUIRES: bro  --help 2>&1 | grep -q mem-leaks
#
# @TEST-GROUP: leaks
#
# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local btest-bg-run bro bro -m -r $TRACES/krb/optional-service-name.pcap
# @TEST-EXEC: btest-bg-wait 60
CVE-2018-17019 (Other, published 2018-09-13T19:29Z)
Description: value: In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/bro/bro
Files changed:
src/analyzer/protocol/irc/IRC.cc
testing/btest/Baseline/scripts.base.protocols.irc.names-weird/weird.log
testing/btest/scripts/base/protocols/irc/names-weird.bro
Commit message: Fix IRC names command parsing


Vulnerable code:
			// Remove nick name.
			parts.erase(parts.begin());
			if ( parts.size() < 2 )

Fixed code:
			if ( parts.size() < 3 )
			// Remove nick name.
			parts.erase(parts.begin());

#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	weird
#open	2018-09-13-00-31-10
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer
#types	time	string	addr	port	addr	port	string	string	bool	string
1536797872.428637	ClEkJM2Vm5giqnMf4h	127.0.0.1	65389	127.0.0.1	6666	irc_invalid_names_line	-	F	bro
#close	2018-09-13-00-31-10
# @TEST-EXEC: bro -C -r $TRACES/irc-353.pcap %INPUT
# @TEST-EXEC: btest-diff weird.log

event irc_names_info(c: connection, is_orig: bool, c_type: string, channel: string, users: string_set)
	{
	print channel, users;
	}
CVE-2022-21668 (Unknown, published 2022-01-10T21:15Z)
Description: value: pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/pypa/pipenv
Files changed:
Commit message: Merge pull request from GHSA-qc9x-gjcv-465w

fix TLS validation for requirements.txt

Vulnerable code:

Fixed code:
CVE-2022-21668 (Unknown, published 2022-01-10T21:15Z)
Description: value: pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/pypa/pipenv
Files changed:
Commit message: Merge pull request from GHSA-qc9x-gjcv-465w

fix TLS validation for requirements.txt

Vulnerable code:

Fixed code:
CVE-2016-10749 (C, published 2019-04-29T14:29Z)
Description: value: parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DaveGamble/cJSON
Files changed:
cJSON.c
Commit message: fix buffer overflow (#30)


Vulnerable code:
	
	while (*end_ptr!='\"' && *end_ptr && ++len) if (*end_ptr++ == '\\') end_ptr++;	/* Skip escaped quotes. */
	

Fixed code:

	while (*end_ptr!='\"' && *end_ptr && ++len)
	{
	    if (*end_ptr++ == '\\')
	    {
		if (*end_ptr == '\0')
		{
		    /* prevent buffer overflow when last input character is a backslash */
		    return 0;
		}
		end_ptr++;	/* Skip escaped quotes. */
	    }
	}
CVE-2019-1010239 (C, published 2019-07-19T17:15Z)
Description: value: DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/DaveGamble/cJSON
Files changed:
cJSON.c
tests/misc_tests.c
Commit message: Fix crash of cJSON_GetObjectItemCaseSensitive when calling it on arrays


Vulnerable code:
        while ((current_element != NULL) && (strcmp(name, current_element->string) != 0))

Fixed code:
        while ((current_element != NULL) && (current_element->string != NULL) && (strcmp(name, current_element->string) != 0))
    if ((current_element == NULL) || (current_element->string == NULL)) {
        return NULL;
    }

static void cjson_get_object_item_should_not_crash_with_array(void) {
    cJSON *array = NULL;
    cJSON *found = NULL;
    array = cJSON_Parse("[1]");

    found = cJSON_GetObjectItem(array, "name");
    TEST_ASSERT_NULL(found);

    cJSON_Delete(array);
}

static void cjson_get_object_item_case_sensitive_should_not_crash_with_array(void) {
    cJSON *array = NULL;
    cJSON *found = NULL;
    array = cJSON_Parse("[1]");

    found = cJSON_GetObjectItemCaseSensitive(array, "name");
    TEST_ASSERT_NULL(found);

    cJSON_Delete(array);
}

    RUN_TEST(cjson_get_object_item_should_not_crash_with_array);
    RUN_TEST(cjson_get_object_item_case_sensitive_should_not_crash_with_array);
CVE-2019-1010239 (C, published 2019-07-19T17:15Z)
Description: value: DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/DaveGamble/cJSON
Files changed:
cJSON.c
tests/misc_tests.c
Commit message: Fix crash of cJSON_GetObjectItemCaseSensitive when calling it on arrays


Vulnerable code:
        while ((current_element != NULL) && (strcmp(name, current_element->string) != 0))

Fixed code:
        while ((current_element != NULL) && (current_element->string != NULL) && (strcmp(name, current_element->string) != 0))
    if ((current_element == NULL) || (current_element->string == NULL)) {
        return NULL;
    }

static void cjson_get_object_item_should_not_crash_with_array(void) {
    cJSON *array = NULL;
    cJSON *found = NULL;
    array = cJSON_Parse("[1]");

    found = cJSON_GetObjectItem(array, "name");
    TEST_ASSERT_NULL(found);

    cJSON_Delete(array);
}

static void cjson_get_object_item_case_sensitive_should_not_crash_with_array(void) {
    cJSON *array = NULL;
    cJSON *found = NULL;
    array = cJSON_Parse("[1]");

    found = cJSON_GetObjectItemCaseSensitive(array, "name");
    TEST_ASSERT_NULL(found);

    cJSON_Delete(array);
}

    RUN_TEST(cjson_get_object_item_should_not_crash_with_array);
    RUN_TEST(cjson_get_object_item_case_sensitive_should_not_crash_with_array);
CVE-2007-10001 (PHP, published 2023-01-05T12:15Z)
Description: value: A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulation of the argument searchstring leads to sql injection. It is recommended to apply a patch to fix this issue. The identifier VDB-217449 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/web-cyradm/web-cyradm
Files changed:
search.php
Commit message: Fixed information disclosure by SQL injection



Vulnerable code:
	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".$_GET['searchstring']."%' AND ".$allowed_domains1."') ORDER BY domain_name";
	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";

Fixed code:
	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".addslashes($_GET['searchstring'])."%' AND ".$allowed_domains1."') ORDER BY domain_name";
	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".addslashes($_GET['searchstring'])."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
CVE-2024-1394 (Go, published 2024-03-21T13:00Z)
Description: value: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs?. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey? and ctx?. That function uses named return parameters to free pkey? and ctx? if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey? and ctx? will be nil inside the deferred function that should free them.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/microsoft/go-crypto-openssl
Files changed:
openssl/evpkey.go
Commit message: Fix memory leak in setupEVP


Vulnerable code:
	init initFunc) (ctx C.GO_EVP_PKEY_CTX_PTR, err error) {

	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
		return 1
	})
	if ctx == nil {
		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
	}

Fixed code:
	init initFunc) (_ C.GO_EVP_PKEY_CTX_PTR, err error) {
	var ctx C.GO_EVP_PKEY_CTX_PTR
	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
		return 1
	})
	if ctx == nil {
		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
	}
CVE-2020-15888 (C, published 2020-07-21T22:15Z)
Description: value: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/lua/lua
Files changed:
ldo.c
Commit message: Keep minimum size when shrinking a stack

When shrinking a stack (during GC), do not make it smaller than the
initial stack size.


Vulnerable code:
  int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
      goodsize < L->stacksize)

Fixed code:
  int goodsize = inuse + BASIC_STACK_SIZE;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)