hitoshura25/cvefixes huggingface dataset:
CVE-2019-1010298 (C, published 2019-07-15T18:15Z)
Description: value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/OP-TEE/optee_os
Files changed:
core/tee/tee_svc_cryp.c
Commit message: svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0011: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>


Vulnerable code:
	params = malloc(sizeof(TEE_Attribute) * num_params);
	params = malloc(sizeof(TEE_Attribute) * num_params);

Fixed code:
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
CVE-2019-1010298 (C, published 2019-07-15T18:15Z)
Description: value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OP-TEE/optee_os
Files changed:
core/tee/tee_svc_cryp.c
Commit message: svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0011: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>


Vulnerable code:
	params = malloc(sizeof(TEE_Attribute) * num_params);
	params = malloc(sizeof(TEE_Attribute) * num_params);

Fixed code:
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
CVE-2019-25052 (C, published 2021-08-11T15:15Z)
Description: value: In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/OP-TEE/optee_os
Files changed:
core/tee/tee_svc_cryp.c
Commit message: cryp: prevent direct calls to update and final functions

With inconsistent or malformed data it has been possible to call
"update" and "final" crypto functions directly. Using a fuzzer tool [1]
we have seen that this results in asserts, i.e., a crash that
potentially could leak sensitive information.

By setting the state (initialized) in the crypto context (i.e., the
tee_cryp_state) at the end of all syscall_*_init functions and then add
a check of the state at the beginning of all update and final functions,
  we prevent direct entrance to the "update" and "final" functions.

[1] https://github.com/MartijnB/optee_fuzzer

Fixes: OP-TEE-2019-0021

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reported-by: Martijn Bogaard <bogaard@riscure.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>


Vulnerable code:

Fixed code:
enum cryp_state {
	CRYP_STATE_INITIALIZED = 0,
	CRYP_STATE_UNINITIALIZED
};

	enum cryp_state state;
	cs->state = CRYP_STATE_UNINITIALIZED;
	cs_dst->state = cs_src->state;

	cs->state = CRYP_STATE_INITIALIZED;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	cs->state = CRYP_STATE_INITIALIZED;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	cs->state = CRYP_STATE_INITIALIZED;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;

	if (cs->state != CRYP_STATE_INITIALIZED)
		return TEE_ERROR_BAD_STATE;
CVE-2022-46152 (C, published 2022-11-29T17:15Z)
Description: value: OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/OP-TEE/optee_os
Files changed:
core/tee/entry_std.c
Commit message: core: tee_entry: fix array out of bounds check in cleanup_shm_refs()

cleanup_shm_refs() can be called with num_params larger than what has
been used by copy_in_params(). If num_params is larger than
TEE_NUM_PARAMS copy_in_params() will return an error and
cleanup_shm_refs() is called to clean up.

This leads to accessing uint64_t saved_attr[TEE_NUM_PARAMS] in
entry_invoke_command() or entry_open_session() out of bounds and
possibly also the u[TEE_NUM_PARAMS] array in struct tee_ta_param.

So fix this by capping num_params TEE_NUM_PARAMS in cleanup_shm_refs().

Fixes: b05cd886e06d ("core: enable non-contiguous temporary reference parameters")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>


Vulnerable code:
	for (n = 0; n < num_params; n++) {

Fixed code:
	for (n = 0; n < MIN((unsigned int)TEE_NUM_PARAMS, num_params); n++) {
CVE-2022-31142 (JavaScript, published 2022-07-14T19:15Z)
Description: value: @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/fastify/fastify-bearer-auth
Files changed:
plugin.js
test/decorate.test.js
Commit message: Merge pull request from GHSA-376v-xgjx-7mfr

* Correctly use crypto.timingSafeEqual

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-Authored-By: Uzlopak <aras.abbasi@googlemail.com>

* apply requested change

Co-authored-by: Uzlopak <aras.abbasi@googlemail.com>

Vulnerable code:
  return keys.findIndex((a) => compare(a, key)) !== -1
  try {
    // may throw if they have different length, can't convert to Buffer, etc...
    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))
  } catch {

Fixed code:
  for (let i = 0, il = keys.length; i < il; ++i) {
    if (typeof keys[i] !== 'string') {
      throw new Error('options.keys has to contain only string entries')
    }
    keys[i] = Buffer.from(keys[i])
  }

  const b = Buffer.from(key)
  return keys.findIndex((a) => compare(a, b)) !== -1
  if (a.length !== b.length) {
    // Delay return with cryptographically secure timing check.
    crypto.timingSafeEqual(a, a)

  return crypto.timingSafeEqual(a, b)

test('verifyBearerAuthFactory', (t) => {
  t.plan(1)
  fastify.ready(() => {
    const keys = { keys: new Set([123456]) }
    t.throws(() => fastify.verifyBearerAuthFactory(keys), /keys has to contain only string entries/)
  })
})
CVE-2022-31142 (JSON, published 2022-07-14T19:15Z)
Description: value: @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/fastify/fastify-bearer-auth
Files changed:
package.json
plugin.js
Commit message: Use `crypto.timingSafeEqual()` instead of `secure-compare` module (#40)

* Use crypto.timingSafeEqual()

* Just try/catch Node core api

Vulnerable code:
    "fastify-plugin": "^2.0.0",
    "secure-compare": "^3.0.1"
const compare = require('secure-compare')

Fixed code:
    "fastify-plugin": "^2.0.0"
const crypto = require('crypto')
// perform constant-time comparison to prevent timing attacks
function compare (a, b) {
  try {
    // may throw if they have different length, can't convert to Buffer, etc...
    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))
  } catch {
    return false
  }
}
CVE-2022-0776 (HTML, published 2022-03-01T09:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hakimel/reveal.js
Files changed:
plugin/notes/speaker-view.html
Commit message: Fix DOM XSS


Vulnerable code:

Fixed code:
					if (window.location.origin !== event.origin){
						return;
					}
CVE-2018-13818 (Other, published 2018-07-10T14:29Z)
Description: value: Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/twigphp/Twig
Files changed:
CHANGELOG
lib/Twig/Environment.php
Commit message: prepared the 2.4.4 release


Vulnerable code:
* 2.4.4 (2017-XX-XX)
    const VERSION = '2.4.4-DEV';
    const EXTRA_VERSION = 'DEV';

Fixed code:
* 2.4.4 (2017-09-27)
    const VERSION = '2.4.4';
    const EXTRA_VERSION = '';
CVE-2022-23614 (Unknown, published 2022-02-04T23:15Z)
Description: value: Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/twigphp/Twig
Files changed:
Commit message: bug #3641 Disallow non closures in `sort` filter when the sanbox mode is enabled (fabpot)

This PR was merged into the 2.x branch.

Discussion
----------

Disallow non closures in `sort` filter when the sanbox mode is enabled

Commits
-------

2eb33080 Disallow non closures in `sort` filter when the sanbox mode is enabled


Vulnerable code:

Fixed code:
CVE-2022-39261 (Unknown, published 2022-09-28T14:15Z)
Description: value: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/twigphp/Twig
Files changed:
Commit message: security #cve- Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) (fabpot)

This PR was merged into the 1.x branch.


Vulnerable code:

Fixed code:
CVE-2021-41176 (PHP, published 2021-10-25T17:15Z)
Description: value: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/pterodactyl/panel
Files changed:
SECURITY.md
resources/scripts/components/NavigationBar.tsx
routes/auth.php
Commit message: (security) use POST for logout rather than GET

see https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6


Vulnerable code:
Please reach out directly to any project team member on Discord when reporting a security vulnerability, or you can send an email to `dane [ät] pterodactyl.io`.
    & > a, & > .navigation-link {
                    <a href={'/auth/logout'}>
                    </a>
Route::get('/logout', 'LoginController@logout')->name('auth.logout')->middleware('auth');

Fixed code:
Please reach out directly to any project team member on Discord when reporting a security vulnerability, or you can send an email to `dane@pterodactyl.io`.
import http from '@/api/http';
import SpinnerOverlay from '@/components/elements/SpinnerOverlay';
import { useState } from 'react';
    & > a, & > button, & > .navigation-link {
    const [ isLoggingOut, setIsLoggingOut ] = useState(false);

    const onTriggerLogout = () => {
        setIsLoggingOut(true);
        http.post('/auth/logout').finally(() => {
            // @ts-ignore
            window.location = '/';
        });
    };
            <SpinnerOverlay visible={isLoggingOut} />
                    <button onClick={onTriggerLogout}>
                    </button>
Route::post('/logout', 'LoginController@logout')->name('auth.logout')->middleware('auth', 'csrf');
CVE-2024-34067 (PHP, published 2024-05-03T18:15Z)
Description: value: Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. This issue has has been addressed in version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the latest version of the panel.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pterodactyl/panel
Files changed:
app/Http/Requests/Admin/Egg/EggFormRequest.php
app/Http/Requests/Api/Client/Servers/Settings/SetDockerImageRequest.php
app/Models/Egg.php
app/Models/Server.php
Commit message: app: improve `docker_image` validation


Vulnerable code:
            'docker_images' => 'required|string',
            'docker_image' => ['required', 'string', Rule::in(array_values($server->egg->docker_images))],
        'docker_images.*' => 'required|string',
        'image' => 'required|string|max:191',

Fixed code:
            'docker_images' => ['required', 'string', 'max:191', 'regex:/^([a-zA-Z0-9 .#_\/\-]*)(\|*)([a-zA-Z0-9 .\/:@]*)$/'],
            'docker_image' => ['required', 'string', 'max:191', 'regex:/^([a-zA-Z0-9 .#_\/\-]*)(\|*)([a-zA-Z0-9 .\/:@]*)$/', Rule::in(array_values($server->egg->docker_images))],
        'docker_images.*' => ['required', 'string', 'max:191', 'regex:/^([a-zA-Z0-9 .#_\/\-]*)(\|*)([a-zA-Z0-9 .\/:@]*)$/'],
        'image' => ['required', 'string', 'max:191', 'regex:/^([a-zA-Z0-9 .#_\/\-]*)(\|*)([a-zA-Z0-9 .\/:@]*)$/'],
CVE-2015-10057 (PHP, published 2023-01-16T19:15Z)
Description: value: A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/little-apps/little-software-stats
Files changed:
inc/class.securelogin.php
login.php
Commit message: fixed security vulnerability allowing an attacker that knows the username to change the password without an activation key


Vulnerable code:
                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd") : ?>		
                        <input name="key" type="hidden" value="<?php echo ( ( isset( $_GET['key'] ) ) ? ( $_GET['key'] ) : ( '' ) ); ?>" />

Fixed code:
        
        if ( empty( $key ) )
        	return __( "Activation key cannot be empty" );
                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd" && !empty( $_GET['key'] ) ) : ?>		
                        <input name="key" type="hidden" value="<?php echo $_GET['key']; ?>" />