starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-1000 (published 2024-04-27T09:15Z)

A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.


Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/cyanomiko/dcnnt-py
commit_details: repo_url: https://github.com/cyanomiko/dcnnt-py
author: AsciiMoth
author_date: 2023-08-14 09:24:18+04:00
msg: Fix command ijection vulnerability

Fix passing of unescaped text to the arguments of notification command
in dcnnt/plugins/notifications.py

This is a high-risk vulnerability that can lead to RCE and allow arbitrary code
execution on the server while the notification showing.

All text received over the network MUST be escaped before being transmitted to
the database or to the shell command arguments.
repository: repo_url: https://github.com/cyanomiko/dcnnt-py
repo_name: cyanomiko/dcnnt-py
description: UI-less tool to connect Android phone with desktop
repo_language: Python
owner: cyanomiko
file_changes: filename: notifications.py
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 import logging
 import subprocess
+from shlex import quote
 
 from .base import Plugin
 from ..common import *
@@ -53,6 +54,6 @@ class NotificationsPlugin(Plugin):
                         except Exception as e:
                             self.log(e, logging.WARNING)
                     icon = icon_path if icon_data else ''
-                    command = cmd.format(uin=uin, name=name, icon=icon, text=text, title=title, package=package)
+                    command = cmd.format(uin=quote(uin), name=quote(name), icon=quote(icon), text=quote(text), title=quote(title), package=quote(package))
                     self.log('Execute: "{}"'.format(command))
                     subprocess.call(command, shell=True)

programming_language: Python
CVE-2021-4276 (published 2022-12-25T11:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIOManager::dsc_import_input_from_source of the file src/DSCIOManager.cpp. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 58922c345d3d1fe89bb2020111873a3e07ca93ac. It is recommended to apply a patch to fix this issue. VDB-216746 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: We do assume that the Data Manager server can only be accessed by authorised users. Because of this, we don’t believe this specific attack is possible without such a compromise of the Data Manager server.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/dns-stats/hedgehog
commit_details: repo_url: https://github.com/dns-stats/hedgehog
author: Sara Dickinson
author_date: 2021-05-13 16:49:28+01:00
msg: Merge pull request #190 from japroc/fix-potential-sqli-through-fs-path

Fix potential sql injection through fs path
repository: repo_url: https://github.com/dns-stats/hedgehog
repo_name: dns-stats/hedgehog
description: DEPRECATED DNS Statistics Presenter (Hedgehog)
repo_language: R
owner: dns-stats
CVE-2022-36086 (published 2022-09-07T23:15Z)

linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1284
cwe_name: Improper Validation of Specified Quantity in Input
description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
extended_description: 
				Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc. When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
			
			

Fix information:
repo_url: https://github.com/rust-osdev/linked-list-allocator
commit_details: repo_url: https://github.com/rust-osdev/linked-list-allocator
author: Philipp Oppermann
author_date: 2022-09-06 21:08:19+02:00
msg: Merge pull request from GHSA-xg8p-34w2-j49j

Infallible extend
repository: repo_url: https://github.com/rust-osdev/linked-list-allocator
repo_name: rust-osdev/linked-list-allocator
repo_language: Rust
owner: rust-osdev
CVE-2021-41131 (published 2021-10-19T18:15Z)

python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

Severity: HIGH
CVSS v2 base score: 8.8 (AV:N/AC:M/Au:N/C:N/I:C/A:C)
CVSS v3 base score: 8.7, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/theupdateframework/python-tuf
commit_details: repo_url: https://github.com/theupdateframework/python-tuf
author: Joshua Lock
author_date: 2021-10-19 14:21:29+01:00
msg: Merge pull request from GHSA-wjw6-2cqr-j4qr

Fix client issue with rolenames as filenames
repository: repo_url: https://github.com/theupdateframework/python-tuf
repo_name: theupdateframework/python-tuf
description: Python reference implementation of The Update Framework (TUF)
repo_language: Python
owner: theupdateframework
CVE-2015-10081 (published 2023-02-20T17:15Z)

A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/arnoldle/phplist-plugin-submitByMailPlugin
commit_details: repo_url: https://github.com/arnoldle/phplist-plugin-submitByMailPlugin
author: Arnold Lesikar
author_date: 2015-06-30 10:35:30-05:00
msg: Added csrf prevention to edit_list.php
repository: repo_url: https://github.com/arnoldle/phplist-plugin-submitByMailPlugin
repo_name: arnoldle/phplist-plugin-submitByMailPlugin
description: Elements of a plugin to submit messages to Phplist by mail. In development. Planning for June release.
repo_language: PHP
owner: arnoldle
file_changes: filename: submitByMailPlugin.php
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 <?php
 
 /**
- * submitByMail plugin version 1.0b2.9
+ * submitByMail plugin version 1.0b2.9a
  * 
  *
  * @category  phplist
@@ -40,7 +40,7 @@ class submitByMailPlugin extends phplistPlugin
 {
     // Parent properties overridden here
     public $name = 'Submit by Mail Plugin';
-    public $version = '1.0b2.9';
+    public $version = '1.0b2.9a';
     public $enabled = false;
     public $authors = 'Arnold Lesikar';
     public $description = 'Allows messages to be submitted to mailing lists by email';

programming_language: PHP
filename: edit_list.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ if (!isSuperUser()){
 	return;
 }
 
+verifyCsrfGetToken();	// Prevent cross-site request forgery
+
 $sbm = $GLOBALS['plugins']['submitByMailPlugin'];
 
 $editid = $_GET['eid'];

programming_language: PHP
CVE-2015-4167 (published 2015-08-05T18:59Z)

The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.

Severity: MEDIUM
CVSS v2 base score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jan Kara
author_date: 2015-01-07 13:49:08+01:00
msg: udf: Check length of extended attributes and allocation descriptors

Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.

Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: inode.c
change_type: ModificationType.MODIFY
diff: @@ -1487,6 +1487,15 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 	}
 	inode->i_generation = iinfo->i_unique;
 
+	/*
+	 * Sanity check length of allocation descriptors and extended attrs to
+	 * avoid integer overflows
+	 */
+	if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
+		goto out;
+	/* Now do exact checks */
+	if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
+		goto out;
 	/* Sanity checks for files in ICB so that we don't get confused later */
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
 		/*

programming_language: C
CVE-2023-41102 (published 2023-11-17T06:15Z)

An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/openNDS/openNDS
commit_details: repo_url: https://github.com/openNDS/openNDS
author: Rob White
author_date: 2023-09-16 11:51:21+01:00
msg: Fix - memory leak when deleting client from client list

Signed-off-by: Rob White <rob@blue-wave.net>
repository: repo_url: https://github.com/openNDS/openNDS
repo_name: openNDS/openNDS
description: openNDS (open Network Demarcation Service) is a high performance, small footprint, Captive Portal.  It provides a border control gateway between a public local area network and the Internet.
repo_language: C
owner: openNDS
file_changes: filename: client_list.c
change_type: ModificationType.MODIFY
diff: @@ -173,10 +173,14 @@ void client_reset(t_client *client)
 	client->hid = safe_strdup(hash);
 	free(hash);
 
-	// Reset custom and client_type
+	// Reset custom, client_type and cpi_query
 	client->custom = safe_calloc(MID_BUF);
 	client->client_type = safe_calloc(STATUS_BUF);
 
+	if (!client->cpi_query) {
+		client->cpi_query = safe_calloc(STATUS_BUF);
+	}
+
 	//Reset cid and remove cidfile using rmcid
 	if (client->cid) {
 
@@ -188,10 +192,10 @@ void client_reset(t_client *client)
 			free(msg);
 			free(cidinfo);
 		}
-
-		client->cid = safe_calloc(SMALL_BUF);
 	}
 
+	client->cid = safe_calloc(SMALL_BUF);
+
 }
 
 /**
@@ -428,6 +432,16 @@ _client_list_free_node(t_client *client)
 		}
 	}
 
+	free(client->token);
+	free(client->hid);
+	free(client->custom);
+	free(client->client_type);
+	free(client->cid);
+
+	if (strcmp(client->cpi_query, "") == 0) {
+		free(client->cpi_query);
+	}
+
 	free(client);
 }
 

programming_language: C
filename: http_microhttpd.c
change_type: ModificationType.MODIFY
diff: @@ -1385,8 +1385,6 @@ static int redirect_to_splashpage(struct MHD_Connection *connection, t_client *c
 	if (strcmp(url, "/login") == 0) {
 		client->cpi_query = safe_strdup(originurl);
 		debug(LOG_DEBUG, "RFC8910 request: %s", client->cpi_query);
-	} else {
-		client->cpi_query = "none";
 	}
 
 	debug(LOG_DEBUG, "originurl_raw: %s", originurl_raw);

programming_language: C
CVE-2017-7541 (published 2017-07-25T04:29Z)

The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Arend van Spriel
author_date: 2017-07-07 21:09:06+01:00
msg: brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

The lower level nl80211 code in cfg80211 ensures that "len" is between
25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN (24) from
"len" so thats's max of 2280.  However, the action_frame->data[] buffer is
only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can
overflow.

	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
	       le16_to_cpu(action_frame->len));

Cc: stable@vger.kernel.org # 3.9.x
Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
Reported-by: "freenerguo(郭大兴)" <freenerguo@tencent.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: cfg80211.c
change_type: ModificationType.MODIFY
diff: @@ -4934,6 +4934,11 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
 					GFP_KERNEL);
 	} else if (ieee80211_is_action(mgmt->frame_control)) {
+		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
+			brcmf_err("invalid action frame length\n");
+			err = -EINVAL;
+			goto exit;
+		}
 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
 		if (af_params == NULL) {
 			brcmf_err("unable to allocate frame\n");

programming_language: C
CVE-2022-4415 (published 2023-01-11T15:15Z)

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Zbigniew Jędrzejewski-Szmek
author_date: 2022-12-20 17:56:28+01:00
msg: Merge branch 'systemd-security/coredump-capabilities'

CVE-2022-4415: systemd: coredump not respecting fs.suid_dumpable kernel setting
Affects systemd >= 247 with libacl support enabled.

This is a merge of https://github.com/systemd/systemd-security/pull/12/.
I'm doing the merge locally because github doesn't support merging directly
from systemd/systemd-security to systemd/systemd.
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd