hitoshura25/cvefixes huggingface dataset:
CVE-2013-6447 (Java, published 2014-01-23T00:55Z)
Description: value: Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/seam2/jboss-seam
Files changed:
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
jboss-seam/src/main/java/org/jboss/seam/util/XML.java
Commit message: https://issues.jboss.org/browse/WFK2-375 enhanced fix

git-svn-id: https://svn.jboss.org/repos/seam/branches/enterprise/WFK-2_1@15651 a9c07ecc-ef43-0410-a306-c911db474e88


Vulnerable code:
      SAXReader xmlReader = new SAXReader();
                 try
                 {
                    Class c = Reflections.classForName(componentName);
                    appendClassSource(response.getOutputStream(), c, types);
                 }
                 catch (ClassNotFoundException ex)
                 {
                    log.error(String.format("Component not found: [%s]", componentName));
                    throw new ServletException("Invalid request - component not found.");
                 }
    SAXReader xmlReader = new SAXReader();
    SAXReader xmlReader = new SAXReader();

Fixed code:
import org.jboss.seam.util.XML;
      SAXReader xmlReader = XML.getSafeSaxReader();
                 log.error(String.format("Component not found: [%s]", componentName));
                 throw new ServletException("Invalid request - component not found.");
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
   
   /**
    * Get safe SaxReader with doctype feature disabled 
    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    * @return
    * @throws Exception
    */
   public static SAXReader getSafeSaxReader() throws Exception
   {
      SAXReader xmlReader = new SAXReader();
      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      return xmlReader;
   }
CVE-2013-6448 (Java, published 2014-01-23T00:55Z)
Description: value: The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/seam2/jboss-seam
Files changed:
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
jboss-seam/src/main/java/org/jboss/seam/util/XML.java
Commit message: https://issues.jboss.org/browse/WFK2-375 enhanced fix

git-svn-id: https://svn.jboss.org/repos/seam/branches/enterprise/WFK-2_1@15651 a9c07ecc-ef43-0410-a306-c911db474e88


Vulnerable code:
      SAXReader xmlReader = new SAXReader();
                 try
                 {
                    Class c = Reflections.classForName(componentName);
                    appendClassSource(response.getOutputStream(), c, types);
                 }
                 catch (ClassNotFoundException ex)
                 {
                    log.error(String.format("Component not found: [%s]", componentName));
                    throw new ServletException("Invalid request - component not found.");
                 }
    SAXReader xmlReader = new SAXReader();
    SAXReader xmlReader = new SAXReader();

Fixed code:
import org.jboss.seam.util.XML;
      SAXReader xmlReader = XML.getSafeSaxReader();
                 log.error(String.format("Component not found: [%s]", componentName));
                 throw new ServletException("Invalid request - component not found.");
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
   
   /**
    * Get safe SaxReader with doctype feature disabled 
    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    * @return
    * @throws Exception
    */
   public static SAXReader getSafeSaxReader() throws Exception
   {
      SAXReader xmlReader = new SAXReader();
      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      return xmlReader;
   }
CVE-2017-20156 (Ruby, published 2022-12-31T10:15Z)
Description: value: A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/exciting-io/printer
Files changed:
lib/printer/jobs/prepare_page.rb
Commit message: Patch shell injection vulnerability in prepare page

By escaping the URL argument, we prevent arbitrary commands from being
able to be injected there.

Fixes #56


Vulnerable code:
    cmd = "phantomjs rasterise.js #{url} #{width} #{path}"

Fixed code:
require "shellwords"
    cmd = "phantomjs rasterise.js #{url.shellescape} #{width} #{path}"
CVE-2010-10004 (PHP, published 2023-01-09T08:15Z)
Description: value: A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. The identifier of the patch is f6bfea49ae16dc6e179df8306d39c3694f1ef186. It is recommended to upgrade the affected component. The identifier VDB-217661 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/simplesamlphp/simplesamlphp-module-infocard
Files changed:
templates/temp-getcardform.php
templates/temp-login.php
Commit message: InfoCard: Fix cross-site scripting.

If the InfoCard module is enabled, it can be used to perform cross-site
scripting attacks on the site where it is installed.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2435 44740490-163a-0410-bde0-09ae8108e29a


Vulnerable code:
				echo '<form action = ?AuthState='.$this->data['stateparams']['AuthState']." method='post'>";
				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.$this->data['stateparams']['AuthState'].'">';
					echo "<input type='hidden' name='username' value='".$this->data['username']."'/>";
					echo "<input type='hidden' name='password' value='".$this->data['password']."'/>";
				echo '<p> <a href="login-infocard.php?AuthState='.$this->data['stateparams']['AuthState'].'">LOGIN</a></p>';
	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo $this->data['stateparams']['AuthState']?>">

Fixed code:
				echo '<form action = ?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState'])." method='post'>";
				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">';
					echo "<input type='hidden' name='username' value='".htmlspecialchars($this->data['username'])."'/>";
					echo "<input type='hidden' name='password' value='".htmlspecialchars($this->data['password'])."'/>";
				echo '<p> <a href="login-infocard.php?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">LOGIN</a></p>';
	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo htmlspecialchars($this->data['stateparams']['AuthState'])?>">
CVE-2013-3722 (C, published 2020-02-17T17:15Z)
Description: value: A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
modules/registrar/lookup.c
Commit message: backport from 1.9 (rev #9980)
fixed temporary GRUU bug that lead to infinite loop
Credits to Tolga Tarhan



git-svn-id: svn+ssh://svn.code.sf.net/p/opensips/svn/trunk@9982 689a6050-402a-0410-94f2-e92a70836424


Vulnerable code:

Fixed code:
			it=it->next;
CVE-2023-27596 (C, published 2023-03-15T21:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the `stream_process` function. This issue was discovered during coverage guided fuzzing of the function `codec_delete_except_re`. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. This issue has been fixed in version 3.1.8 and 3.2.5.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
modules/sipmsgops/codecs.c
Commit message: [sipmsgops] fix codec_delete_XX() parsing

Issue discovered during OpenSIPS Security Audit 2021/2022,
by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-3ghx-j39m-cw4f


Vulnerable code:
						while (*(--tmp) == ' ') {

Fixed code:
						while (tmp>lmp->u.value && *(--tmp) == ' ') {
CVE-2023-27598 (C, published 2023-03-15T21:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
parser/parse_via.c
Commit message: [core] fix parse_via() parsing

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx


Vulnerable code:
					case F_HOST:

Fixed code:
CVE-2023-27599 (C, published 2023-03-15T21:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
parser/parse_to.c
Commit message: [sipmsgops] fix parse_to_param() parsing

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qvj2-vqrg-f5jx


Vulnerable code:

Fixed code:
						if (tmp+1==end)
							goto parse_error;
	if (status==PARA_VALUE_QUOTED) {
			LM_ERR("unexpected end of header in state %d\n", status);
			goto parse_error;
	}
	LM_DBG("end of header reached, state=%d\n", status);
CVE-2023-27600 (C, published 2023-03-15T22:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`).

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
modules/sipmsgops/codecs.c
Commit message: [sipmsgops] fix codec_delete_XX() parsing (2)

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx


Vulnerable code:
	end++;

Fixed code:
	if ( *end == '\n')
		end++;
CVE-2023-27601 (C, published 2023-03-15T22:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`):

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
modules/sipmsgops/codecs.c
Commit message: [sipmsgops] fix codec_delete_XX() parsing

Issue discovered during OpenSIPS Security Audit 2021,
        by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h


Vulnerable code:
int delete_sdp_line( struct sip_msg * msg, char * s)
	while(*start != '\n')
	while(*end != '\n')
					if( delete_sdp_line( msg, payload->rtp_enc.s) < 0 )
					if( delete_sdp_line( msg, payload->fmtp_string.s) < 0 )

Fixed code:
/* deletes a SDP line (from a stream) by giving a pointer within the line.
 * The stream is used to safeguard the identification of the line boundries.
 */
int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *stream)
	while(*start != '\n' && start > stream->body.s)
	while(*end != '\n' && end < (stream->body.s+stream->body.len) )
					if( delete_sdp_line( msg, payload->rtp_enc.s, cell) < 0 )
					if( delete_sdp_line( msg, payload->fmtp_string.s, cell) < 0 )
CVE-2023-28097 (C, published 2023-03-15T23:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
parser/parse_content.c
Commit message: core: Fix Content-Length parsing

Issue discovered during OpenSIPS Security Audit 2022,
        by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq


Vulnerable code:
		number = number*10 + (*p)-'0';
		if (number<0) {
			LM_ERR("number overflow at pos %d in len number [%.*s]\n",

Fixed code:
		/* do not actually cause an integer overflow, as it is UB! --liviu */
		if (number > 214748363) {
			LM_ERR("integer overflow risk at pos %d in len number [%.*s]\n",

		number = number*10 + (*p)-'0';
CVE-2023-28098 (C, published 2023-03-15T23:15Z)
Description: value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing
functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenSIPS/opensips
Files changed:
parser/digest/param_parser.c
Commit message: parse_param_name(): Improve param parsing macros

Issue discovered during OpenSIPS Security Audit 2021,
    by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h


Vulnerable code:
        p += 4;           \
        p += 4;                           \
	}
        p += 4;                           \
	}
        p += 4;           \
        p += 4;                                   \
        p += 4;                                   \
        p += 4;           \

Fixed code:
#define NEED(bytes) do { if (end - p < (bytes)) goto other; } while (0)
        p += 4; NEED(4);  \
        p += 4; NEED(1);                  \
	}                                 \
        goto other;
        p += 4; NEED(1);                  \
	}                                 \
        goto other;
        p += 4; NEED(4);  \
        p += 4; NEED(2);                          \
        p += 4; NEED(2);                          \
        p += 4; NEED(5);  \
CVE-2017-7185 (C, published 2017-04-10T15:59Z)
Description: value: Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/cesanta/mongoose
Files changed:
mongoose.c
Commit message: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307


Vulnerable code:

Fixed code:
  if (pd->mp_stream.boundary == NULL) {
    pd->mp_stream.state = MPS_FINALIZE;
    DBG(("Invalid request: boundary not initilaized"));
    return 0;
  }