hitoshura25/cvefixes huggingface dataset:
CVE-2024-39915 (Other, published 2024-07-15T20:15Z)
Description: value: Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the url parameter when generating a PDF report. An authorized attacker with access to the reporting functionality could inject arbitrary commands that would be executed when the script /script/html2pdf.sh is called. The vulnerability can be exploited by an authorized user with network access. This issue has been addressed in version 3.16. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sni/Thruk
Files changed:
Changes
plugins/plugins-available/reports2/lib/Thruk/Utils/Reports/Render.pm
Commit message: fix using unescaped url in reports

skip spawing a shell when generating pdf report from custom url. Insufficient
escaping of the url lead to remote code execution vulnerability.

references:

- https://github.com/sni/Thruk/security/advisories/GHSA-r7gx-h738-4w6f

credits:

- https://github.com/OOsipova
- https://github.com/BlackFan (Kaspersky)


Vulnerable code:
        my $cmd = $c->config->{home}.'/script/html2pdf.sh "'.$url.'" "'.$c->stash->{'attachment'}.'.pdf"';
        Thruk::Utils::IO::cmd($cmd);

Fixed code:
          - fix using unescaped url in reports
        Thruk::Utils::IO::cmd($c, [$c->config->{home}.'/script/html2pdf.sh', $url, $c->stash->{'attachment'}.'.pdf']);
CVE-2016-15019 (Ruby, published 2023-01-15T19:15Z)
Description: value: A vulnerability was found in tombh jekbox. It has been rated as problematic. This issue affects some unknown processing of the file lib/server.rb. The manipulation leads to exposure of information through directory listing. The attack may be initiated remotely. The patch is named 64eb2677671018fc08b96718b81e3dbc83693190. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218375.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/tombh/jekbox
Files changed:
lib/file_handler.rb
lib/server.rb
spec/fixtures/jekbox.example.com/_site/deep/index.html
spec/server_spec.rb
Commit message: Ensure that requests ending with a slash and without try looking for an index.html file. And prevent malicious directory traversing


Vulnerable code:

      :body => ::File.read(path),
      :time => ::File.mtime(path).httpdate

    if @request.path_info.end_with?('/')
      normalized = @request.path_info + 'index.html'
    else
      normalized = @request.path_info
    end
    File.join @root, '_site', normalized
    if File.exist? @file
    it 'should find the index.html file when a URL without a file is requested' do
      get 'http://jekbox.example.com'
      expect(last_response.body).to eq "The index page\n"
      get 'http://jekbox.example.com/foo.css'

Fixed code:
# Useful file methods
      body: ::File.read(path),
      time: ::File.mtime(path).httpdate
    path = File.expand_path File.join @root, '_site', @request.path_info
    with_index = File.join path, 'index.html'
    if File.file? path
      path
    elsif File.file? with_index
      with_index
    end
    if @file
    fail unless @file.include? @root # Prevent malicious path requests
Deep page
    context 'Finding the index.html file when a URL without a file is requested' do
      it 'should use index.html when root is requested' do
        get 'http://jekbox.example.com'
        expect(last_response.body).to eq "The index page\n"
      end

      it 'should use index.html when a / is present' do
        get 'http://jekbox.example.com/deep/'
        expect(last_response.body).to eq "Deep page\n"
      end

      it 'should use index.html when a / is not present' do
        get 'http://jekbox.example.com/deep'
        expect(last_response.body).to eq "Deep page\n"
      end
      get 'http://jekbox.example.com/assets/foo.css'

    it 'should find a normal file' do
      expect do
        get 'http://jekbox.example.com/../../../spec_helper.rb'
      end.to raise_error RuntimeError
    end
CVE-2018-6758 (C, published 2018-02-06T18:29Z)
Description: value: The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/unbit/uwsgi
Files changed:
core/utils.c
Commit message: improve uwsgi_expand_path() to sanitize input, avoiding stack corruption and potential security issue


Vulnerable code:
	char src[PATH_MAX + 1];
	memcpy(src, dir, dir_len);
	src[dir_len] = 0;

Fixed code:
	if (dir_len > PATH_MAX)
	{
		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX);
		return NULL;
	}
	char *src = uwsgi_concat2n(dir, dir_len, "", 0);
		free(src);
	free(src);
CVE-2018-17605 (Other, published 2018-09-28T09:29Z)
Description: value: An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/bertramdev/asset-pipeline
Files changed:
asset-pipeline-grails/src/main/groovy/asset/pipeline/AssetPipelineFilter.groovy
asset-pipeline-servlet/src/main/groovy/asset/pipeline/servlet/AssetPipelineFilterCore.groovy
build.gradle
Commit message: fixing jetty classloader vulnerability with potential reverse file traverse route when running servlet based apps in jetty


Vulnerable code:

	version = '3.0.3'

Fixed code:
import asset.pipeline.AssetHelper
			fileUri = AssetHelper.normalizePath(fileUri) //JETTY Security bug, we MUST prevent reverse traversal
import asset.pipeline.AssetHelper
		fileUri = AssetHelper.normalizePath(fileUri) //JETTY Security bug, we MUST prevent reverse 
	version = '3.0.4'
CVE-2022-33127 (Ruby, published 2022-06-23T17:15Z)
Description: value: The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/samg/diffy
Files changed:
lib/diffy/diff.rb
Commit message: Remove windows specific exec.  Open2.capture3 should work on all
platforms.


Vulnerable code:
        if WINDOWS
          # don't use open3 on windows
          cmd = sprintf '"%s" %s %s', diff_bin, diff_options.join(' '), @paths.map { |s| %("#{s}") }.join(' ')
          diff = `#{cmd}`
        else
          diff = Open3.popen3(diff_bin, *(diff_options + @paths)) { |i, o, e| o.read }
        end

Fixed code:
        diff, stderr, process_status = Open3.capture3(diff_bin, *(diff_options + @paths))
CVE-2021-4288 (Other, published 2022-12-27T13:15Z)
Description: value: A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 35f81901a4cb925747a9615b8706f5079d2196a1. It is recommended to upgrade the affected component. The identifier VDB-216881 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-referenceapplication
Files changed:
omod/src/main/webapp/pages/userApp.gsp
Commit message: RA-1424: escapeJs vulnerable to XSS (#92)



Vulnerable code:
        <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.escapeJs(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />

Fixed code:
        <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.encodeJavaScript(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />
CVE-2021-4289 (Unknown, published 2022-12-27T13:15Z)
Description: value: A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe5964182659f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-referenceapplication
Files changed:
Commit message: Merge pull request #89 from The-Lady/EMPT110

RA-1875: EMPT110 Fixed XSS Vulnerability in AppId field on User App Page

Vulnerable code:

Fixed code:
CVE-2018-14650 (Python, published 2018-09-27T20:29Z)
Description: value: It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.
Severity: LOW (CVSS v3 base score: 5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/sosreport/sos-collector
Files changed:
soscollector/sos_collector.py
Commit message: [sos_collector] Set umask for all files created

Sets a umask of 0077 for all files created by sos-collector. This
ensures collected sosrpeorts are not world readable and maintains the
original permissions of the sos archives.

Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>


Vulnerable code:

Fixed code:
        os.umask(0077)
CVE-2024-22212 (Unknown, published 2024-01-18T19:15Z)
Description: value: Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/nextcloud/globalsiteselector
Files changed:
Commit message: Merge pull request #138 from nextcloud/fix/noid/auth-saml

auth check on slave

Vulnerable code:

Fixed code:
CVE-2019-14462 (C, published 2019-07-31T23:15Z)
Description: value: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/stephane/libmodbus
Files changed:
src/modbus.c
Commit message: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.


Vulnerable code:
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {

Fixed code:
        int nb_bits = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
        int nb_bytes = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
CVE-2019-14463 (C, published 2019-07-31T23:15Z)
Description: value: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/stephane/libmodbus
Files changed:
src/modbus.c
Commit message: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.


Vulnerable code:
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {

Fixed code:
        int nb_bits = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
        int nb_bytes = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
CVE-2022-0367 (C, published 2022-08-29T15:15Z)
Description: value: A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/stephane/libmodbus
Files changed:
src/modbus.c
Commit message: modbus_reply: fix copy & paste error in sanity check (fixes #614)

While handling MODBUS_FC_WRITE_AND_READ_REGISTERS, both address offsets
must be checked, i.e. the read and the write address must be within the
mapping range.

At the moment, only the read address was considered, it looks like a
simple copy and paste error, so let's fix it.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>


Vulnerable code:
                   mapping_address < 0 ||

Fixed code:
                   mapping_address_write < 0 ||
CVE-2022-31106 (Unknown, published 2022-06-28T18:15Z)
Description: value: Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Clever/underscore.deep
Files changed:
Commit message: Merge pull request from GHSA-8j79-hfj5-f2xm

0.5.3

Vulnerable code:

Fixed code:
CVE-2021-39179 (JSON, published 2021-10-29T14:15Z)
Description: value: DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects the `/api/trackedEntityInstances` and `/api/trackedEntityInstances/query` API endpoints in all DHIS2 versions 2.34, 2.35, and 2.36. It also affects versions 2.32 and 2.33 which have reached _end of support_ - exceptional security updates have been added to the latest *end of support* builds for these versions. Versions 2.31 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user - the vulnerability requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. Security patches are available in DHIS2 versions 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7, and 2.36.4. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the `/api/trackedEntityInstances`, and `/api/trackedEntityInstances/query` endpoints as a temporary workaround while waiting to upgrade.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dhis2/dhis2-core
Files changed:
.patches/security/advisories.json
Commit message: build: correct patch PRs (#8771)

* build: correct patch PRs for CVE-2021-39179

* Update advisories.json

Vulnerable code:
            "prNumber": 11,
            "target": "patch/2.34.7"
          },
          {
            "prNumber": 4,
            "prNumber": 3,
            "prNumber": 6,
            "prNumber": 3,
            "prNumber": 2,

Fixed code:
            "prNumber": 14,
            "prNumber": 16,
            "prNumber": 7,
            "prNumber": 8,
            "prNumber": 9,
CVE-2021-26926 (C, published 2021-02-23T18:15Z)
Description: value: A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jasper-software/jasper
Files changed:
src/libjasper/jp2/jp2_dec.c
Commit message: Fixes #264.

The JP2 decoder was allowing the decoding of a code stream to be
attempted when the stream has inconsistent values for the number of
components and/or the component types.  For such invalid streams,
only a warning would be issued and decoding would proceed.  This is
dangerous, however, as it can lead to many unexpected paths through
the code, which in some cases have been demonstrated to result in
security vulnerabilities.  This code change makes decoding of these
types invalid code streams a hard error.


Vulnerable code:
		jas_eprintf("warning: number of components mismatch\n");
		jas_eprintf("warning: component data type mismatch (IHDR)\n");
		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
		  dec->image))) {
			jas_eprintf("warning: number of components mismatch\n");
					jas_eprintf("warning: component data type mismatch (BPCC)\n");

Fixed code:
		jas_eprintf("error: number of components mismatch (IHDR)\n");
		goto error;
		jas_eprintf("error: component data type mismatch (IHDR)\n");
		goto error;
		if (dec->bpcc->data.bpcc.numcmpts !=
		  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
			jas_eprintf("error: number of components mismatch (BPCC)\n");
			goto error;
					jas_eprintf("error: component data type mismatch (BPCC)\n");
						goto error;