hitoshura25/cvefixes huggingface dataset:
CVE-2022-2067 (PHP, published 2022-06-13T13:15Z)
Description: value: SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
CHANGES.md
modules/Custom/includes/RegistrationSave.fnc.php
modules/School_Setup/Calendar.php
modules/School_Setup/MarkingPeriods.php
modules/School_Setup/SchoolFields.php
modules/Students/includes/AddressFields.php
modules/Students/includes/PeopleFields.php
modules/Students/includes/StudentFields.php
modules/Users/UserFields.php
Commit message: Fix SQL injection escape DB identifier


Vulnerable code:
				$fields .= $column . ',';
							$fields .= $column . ',';
					$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';

Fixed code:
- Fix SQL injection escape DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
				$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
					$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
CVE-2022-2714 (PHP, published 2022-09-06T11:15Z)
Description: value: Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-130 \u2014 Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
CHANGES.md
Warehouse.php
Commit message: Limit $_POST array size to a maximum of 16MB


Vulnerable code:

Fixed code:
- Limit `$_POST` array size to a maximum of 16MB in Warehouse.php
/**
 * Limit $_POST array size to a maximum of 16MB
 *
 * $_POST array size is limited by PHP post_max_size configuration option
 * But this includes $_FILES as well & post_max_size must be greater than upload_max_filesize
 * One may want to be able to upload a 100MB file, but may not want the $_POST var,
 * with for example the text or HTML of a textarea to be 100MB and later stored in database.
 */
if ( ! defined( 'ROSARIO_POST_MAX_SIZE_LIMIT' ) )
{
	/**
	 * Fix a limit of 16MB based on MySQL max_allowed_packet default limit
	 * Limit size can be overriden in the config.inc.php file
	 */
	define( 'ROSARIO_POST_MAX_SIZE_LIMIT', 16 * 1024 * 1024 ); // 16MB in bytes.
}

if ( $_POST
	&& strlen( serialize( $_POST ) ) > ROSARIO_POST_MAX_SIZE_LIMIT )
{
	$post_max_size_limit = function( $value ) {
		if ( strlen( $value ) > ( ROSARIO_POST_MAX_SIZE_LIMIT / 4 ) )
		{
			// Reset value > limit / 4, or else we would send it in the HackingLog email!
			return 'ROSARIO_POST_MAX_SIZE_LIMIT / 4 reached.';
		}

		return $value;
	};

	array_rwalk( $_POST, $post_max_size_limit );

	array_rwalk( $_REQUEST, $post_max_size_limit );

	require_once 'ProgramFunctions/HackingLog.fnc.php';

	// Do not translate.
	$error[] = 'You are submitting too much data: over the ' .
		( ROSARIO_POST_MAX_SIZE_LIMIT / 1024 / 1024 ) .
		'M limit. Try reducing the data you are submitting.';

	HackingLog();
}
CVE-2023-0994 (PHP, published 2023-02-24T02:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
CHANGES.md
modules/Grades/includes/StudentAssignments.fnc.php
Commit message: PHP<7 Fix add microseconds to filename to make it harder to predict


Vulnerable code:
	$timestamp = new \DateTime();

	$timestamp = $timestamp->format( 'Y-m-d H:i:s.u' );
	$microseconds = new \DateTime();

	$microseconds = $microseconds->format( 'u' );

Fixed code:
Changes in 10.8.2
-----------------
- PHP<7 Fix add microseconds to filename to make it harder to predict in StudentAssignments.fnc.php, thanks to @jeffreygaor

	$timestamp = date( 'Y-m-d His' ) . '.' . substr( (string) microtime(), 2, 6 );
	$microseconds = substr( (string) microtime(), 2, 6 );
CVE-2023-2665 (PHP, published 2023-05-12T01:15Z)
Description: value: Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
CHANGES.md
ProgramFunctions/FileUpload.fnc.php
modules/Accounting/functions.inc.php
modules/School_Setup/PortalNotes.php
modules/Student_Billing/functions.inc.php
Commit message: Add microseconds to filename format to make it harder to predict


Vulnerable code:
		$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
						$error
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );

Fixed code:
- Add microseconds to filename format to make it harder to predict in FileUpload.fnc.php, Accounting/functions.php, PortalNotes.php & Student_Billing/functions.php
		// @since 11.0 Add microseconds to filename format to make it harder to predict.
		$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
	// @since 11.0 Add microseconds to filename format to make it harder to predict.
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
					$file_name_no_ext = no_accents( mb_substr(
						$_FILES['FILE_ATTACHED_FILE']['name'],
						0,
						mb_strrpos( $_FILES['FILE_ATTACHED_FILE']['name'], '.' )
					) );

					// @since 11.0 Add microseconds to filename format to make it harder to predict.
					$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );

					// File attached to portal notes
						$error,
						'',
						$file_name_no_ext
	// @since 11.0 Add microseconds to filename format to make it harder to predict.
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
CVE-2018-25077 (Other, published 2023-01-18T01:15Z)
Description: value: A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/melnaron/mel-spintax
Files changed:
.gitignore
.npmignore
lib/spintax.js
package.json
Commit message: Fix possible ReDoS attack


Vulnerable code:
		return text.match(/{.*(\|.*)+}/) !== null;
		return text.match(/{([^{}]+?)}/);
		return text.match(/({[^}]*\|)|(\|[^{]*})/) === null;
  "version": "1.0.2",

Fixed code:
.vscode
.vscode
		return text.match(/\{[^}]*\|*[^}]*\}/) !== null;
		return text.match(/\{([^{}]+?)\}/);
		return text.match(/(\{[^}]*\|)|(\|[^{]*\})/) === null;
  "version": "1.0.3",
CVE-2023-33201 (Java, published 2023-07-05T03:15Z)
Description: value: Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/bcgit/bc-java
Files changed:
prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java
Commit message: added filter encode to search


Vulnerable code:
        String filter = attributeName + "=" + attributeValue;

Fixed code:
    private static String[] FILTER_ESCAPE_TABLE = new String['\\' + 1];


    static {

        // Filter encoding table -------------------------------------

        // fill with char itself
        for (char c = 0; c < FILTER_ESCAPE_TABLE.length; c++) {
            FILTER_ESCAPE_TABLE[c] = String.valueOf(c);
        }

        // escapes (RFC2254)
        FILTER_ESCAPE_TABLE['*'] = "\\2a";
        FILTER_ESCAPE_TABLE['('] = "\\28";
        FILTER_ESCAPE_TABLE[')'] = "\\29";
        FILTER_ESCAPE_TABLE['\\'] = "\\5c";
        FILTER_ESCAPE_TABLE[0] = "\\00";

    }

    /**
     * Escape a value for use in a filter.
     * @param value the value to escape.
     * @return a properly escaped representation of the supplied value.
     */
    private String filterEncode(String value)
    {
        if (value == null)
        {
            return null;
        }

        // make buffer roomy
        StringBuilder encodedValue = new StringBuilder(value.length() * 2);

        int length = value.length();

        for (int i = 0; i < length; i++) {

            char c = value.charAt(i);

            if (c < FILTER_ESCAPE_TABLE.length) {
                encodedValue.append(FILTER_ESCAPE_TABLE[c]);
            }
            else {
                // default: add the char
                encodedValue.append(c);
            }
        }

        return encodedValue.toString();
    }
        String filter = attributeName + "=" + filterEncode(attributeValue);
        System.out.println(filter);
CVE-2024-34078 (Python, published 2024-05-06T15:15Z)
Description: value: html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/matthiask/html-sanitizer
Files changed:
CHANGELOG.rst
html_sanitizer/sanitizer.py
html_sanitizer/tests.py
Commit message: Normalize unicode earlier


Vulnerable code:
        # normalize unicode
        if self.keep_typographic_whitespace:
            html = unicodedata.normalize("NFC", html)
        else:
            html = unicodedata.normalize("NFKC", html)


Fixed code:
- **Vulnerability:** Fixed an issue where normalizing unicode too late in the
  process would keep disallowed tags when using specially crafted HTML. Fixed
  in 2.4.2.


        # normalize unicode
        if self.keep_typographic_whitespace:
            html = unicodedata.normalize("NFC", html)
        else:
            html = unicodedata.normalize("NFKC", html)


    def test_normalize_early(self):
        self.run_tests(
            [
                (
                    "\uff1cimg src=x onerror=\uff02alert(window.location)\uff02\uff1e",
                    "",
                ),
            ]
        )
CVE-2020-19316 (PHP, published 2021-12-20T20:15Z)
Description: value: OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/laravel/framework
Files changed:
src/Illuminate/Filesystem/Filesystem.php
Commit message: use escapeshellarg on windows symlink


Vulnerable code:
        exec("mklink /{$mode} \"{$link}\" \"{$target}\"");

Fixed code:
        exec("mklink /{$mode} ".escapeshellarg($link)." ".escapeshellarg($target));
CVE-2014-9625 (C, published 2020-01-24T22:15Z)
Description: value: The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/videolan/vlc
Files changed:
src/misc/update.c
Commit message: misc: update: fix buffer overflow in updater

On 32 bit builds, parsing of update status files with a size of
4294967295 or more lead to an integer truncation in a call to malloc
and a subsequent buffer overflow. This happened prior to checking the
files' signature. The commit fixes this by disallowing overly large
status files (above 65k in practice)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:

Fixed code:

    if( i_read < 0 || i_read >= UINT16_MAX)
    {
        msg_Err(p_update->p_libvlc, "Status file too large");
        goto error;
    }
CVE-2014-9626 (C, published 2020-01-24T22:15Z)
Description: value: Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/videolan/vlc
Files changed:
modules/demux/mp4/libmp4.c
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:

Fixed code:
    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9627 (C, published 2020-01-24T22:15Z)
Description: value: The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/videolan/vlc
Files changed:
modules/demux/mp4/libmp4.c
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:

Fixed code:
    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9628 (C, published 2020-01-24T22:15Z)
Description: value: The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/videolan/vlc
Files changed:
modules/demux/mp4/libmp4.c
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:

Fixed code:
    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9629 (C, published 2020-01-24T22:15Z)
Description: value: Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/videolan/vlc
Files changed:
modules/codec/schroedinger.c
Commit message: codec: schroedinger: fix potential buffer overflow.

The variable len is a raw 32 bit value read using GetDWBE. If this
value is larger than UINT32_MAX - sizeof(eos), this will cause an
integer overflow in the subsequent call to malloc, and finally a
buffer overflow when calling memcpy. We fix this by checking len
accordingly.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:

Fixed code:

                    if( len > UINT32_MAX - sizeof( eos ) )
                        return NULL;
CVE-2014-9630 (C, published 2020-01-24T22:15Z)
Description: value: The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/videolan/vlc
Files changed:
modules/stream_out/rtpfmt.c
Commit message: stream_out: rtp: don't use VLA for user controlled data

It should fix a possible invalid memory access

When streaming ogg-files via rtp, an ogg-file can trigger an invalid
write access using an overly long 'configuration' string.

The original code attemps to allocate space to hold the string on the stack
and hence, cannot verify if allocation succeeds. Instead, we now allocate the
buffer on the heap and return if allocation fails.

In detail, rtp_packetize_xiph_config allocates a buffer on the stack at (1) where
the size depends on the local variable 'len'. The variable 'len' is
calculated at (0) to be the length of a string contained in a specially
crafted Ogg Vorbis file, and therefore, it is attacker-controlled.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>


Vulnerable code:
    char b64[len + 1];

Fixed code:

    char *b64 = malloc(len + 1);
    if(!b64)
        return VLC_EGENERIC;

    free(b64);
CVE-2013-4160 (C, published 2014-01-21T18:55Z)
Description: value: Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mm2/Little-CMS
Files changed:
ChangeLog
src/cmsnamed.c
src/cmsopt.c
Commit message: Non happy-path fixes


Vulnerable code:
    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix));
    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix));
        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name,
                    sizeof(NamedColorList ->List[NamedColorList ->nColors].Name));


Fixed code:
Added some checks for non-happy path, mostly failing mallocs
    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name, cmsMAX_PATH-1);
    if (Seq -> seq == NULL) {
        _cmsFree(ContextID, Seq);
        return NULL;
    }
        if (c16->Curves[i] == NULL) {

            for (j=0; j < i; j++) {
                _cmsFree(ContextID, c16->Curves[j]);
            }
            _cmsFree(ContextID, c16->Curves);
            _cmsFree(ContextID, c16);
            return NULL;
        }