starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-28232 (published 2024-04-01T17:15Z)

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
commit_details: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
author: CorrectRoad
author_date: 2024-03-12 18:17:46+08:00
msg: Merge pull request from GHSA-hcw2-2r9c-gc6p
repository: repo_url: https://github.com/IceWhaleTech/CasaOS-UserService
repo_name: IceWhaleTech/CasaOS-UserService
description: User Service provides user management functionalities to CasaOS.
repo_language: Go
owner: IceWhaleTech
file_changes: filename: user.go
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,7 @@ func PostUserLogin(c *gin.Context) {
 	user := service.MyService.User().GetUserAllInfoByName(username)
 	if user.Id == 0 {
 		c.JSON(common_err.CLIENT_ERROR,
-			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
+			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
 		return
 	}
 	if user.Password != encryption.GetMD5ByStr(password) {

programming_language: Go
CVE-2022-31026 (published 2022-06-09T13:15Z)

Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/github/trilogy
commit_details: repo_url: https://github.com/github/trilogy
author: John Hawthorn
author_date: 2022-06-06 13:12:42-07:00
msg: Merge pull request from GHSA-5g4r-2qhx-vqfm

Verify exact length of auth_data_len
repository: repo_url: https://github.com/github/trilogy
repo_name: trilogy-libraries/trilogy
description: Trilogy is a client library for MySQL-compatible database servers, designed for performance, flexibility, and ease of embedding.
repo_language: C
owner: github
CVE-2015-10018 (published 2023-01-06T13:15Z)

A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/DBRisinajumi/d2files
commit_details: repo_url: https://github.com/DBRisinajumi/d2files
author: Uldis Nelsons
author_date: 2015-01-04 12:38:39+02:00
msg: SQL injection problem
repository: repo_url: https://github.com/DBRisinajumi/d2files
repo_name: DBRisinajumi/d2files
repo_language: PHP
owner: DBRisinajumi
file_changes: filename: D2filesController.php
change_type: ModificationType.MODIFY
diff: @@ -114,7 +114,7 @@ class D2filesController extends Controller
         //if (!Yii::app()->user->checkAccess($model_name . '.uploadD2File')) {
         D2files::extendedCheckAccess($model_name . '.uploadD2File');
         
-        if (!$this->performReadValidation($model_name, $model_id)) {
+        if (!$this->performReadValidation($model_name, (int)$model_id)) {
             throw new CHttpException(403, Yii::t("D2filesModule.model","You are not authorized to perform this action."));
         }
 
@@ -122,7 +122,7 @@ class D2filesController extends Controller
         $oUploadHandler = new UploadHandlerD2files(
                         array(
                             'model_name' => $model_name,
-                            'model_id' => $model_id,
+                            'model_id' => (int)$model_id,
                         )
         );
         
@@ -175,7 +175,7 @@ class D2filesController extends Controller
         $oUploadHandler = new UploadHandlerD2files(
                         array(
                             'model_name' => $model->model,
-                            'model_id' => $id,
+                            'model_id' => (int)$id,
                             'download_via_php' => TRUE,
                             'file_name' => $model->file_name,
                         )

programming_language: PHP
CVE-2022-23126 (published 2022-01-24T19:15Z)

TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/adriankumpf/teslamate
commit_details: repo_url: https://github.com/adriankumpf/teslamate
author: Adrian Kumpf
author_date: 2022-01-12 00:20:38+01:00
msg: Disable anonymous login to Grafana
repository: repo_url: https://github.com/adriankumpf/teslamate
repo_name: teslamate-org/teslamate
description: A self-hosted data logger for your Tesla  🚘
repo_language: Elixir
owner: adriankumpf
file_changes: filename: Dockerfile
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 FROM grafana/grafana:7.5.12
 
 ENV GF_ANALYTICS_REPORTING_ENABLED=FALSE \
-    GF_AUTH_ANONYMOUS_ENABLED=true \
+    GF_AUTH_ANONYMOUS_ENABLED=false \
     GF_AUTH_BASIC_ENABLED=false \
     GF_PATHS_PLUGINS="/var/lib/grafana-plugins" \
     GF_SECURITY_ADMIN_PASSWORD=admin \

programming_language: Shell
filename: docker.md
change_type: ModificationType.MODIFY
diff: @@ -90,7 +90,7 @@ This setup is recommended only if you are running TeslaMate **on your home netwo
 
 1. Open the web interface [http://your-ip-address:4000](http://localhost:4000)
 2. Sign in with your Tesla account
-3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000).
+3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000). Log in with the default user `admin` (inital password `admin`) and enter a secure password.
 
 ## [Update](../upgrading.mdx)
 

programming_language: Markdown
CVE-2021-29573 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` is vulnerable to a division by 0. The implementation(https://github.com/tensorflow/tensorflow/blob/279bab6efa22752a2827621b7edb56a730233bd8/tensorflow/core/kernels/maxpooling_op.cc#L1033-L1034) fails to validate that the batch dimension of the tensor is non-zero, before dividing by this quantity. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-05-05 14:34:54-07:00
msg: Don't do any work if output tensor is null (prevent div by 0)

PiperOrigin-RevId: 372208700
Change-Id: Iea6b6293e887ade8538facfdb50fb931e17f511e
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: maxpooling_op.cc
change_type: ModificationType.MODIFY
diff: @@ -1088,6 +1088,8 @@ class MaxPoolingGradWithArgmaxOp : public OpKernel {
     OP_REQUIRES_OK(context, context->forward_input_or_allocate_output(
                                 {0}, 0, out_shape, &grad_out));
 
+    if (out_shape.num_elements() == 0) return;  // nothing to be done
+
     LaunchMaxPoolingGradWithArgmax<Device, T>::launch(
         context, params, grad_in, argmax, grad_out, include_batch_in_index_);
   }

programming_language: C++
CVE-2019-25050 (published 2021-07-20T07:15Z)

netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/OSGeo/gdal
commit_details: repo_url: https://github.com/OSGeo/gdal
author: Even Rouault
author_date: 2019-06-06 21:56:17+02:00
msg: netCDF: avoid buffer overflow. master only. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143. Credit to OSS Fuzz
repository: repo_url: https://github.com/OSGeo/gdal
repo_name: OSGeo/gdal
description: GDAL is an open source MIT licensed translator library for raster and vector geospatial data formats.
repo_language: C++
owner: OSGeo
file_changes: filename: netcdfsg.cpp
change_type: ModificationType.MODIFY
diff: @@ -54,26 +54,21 @@ namespace nccfdriver
      */
     std::string& attrf(int ncid, int varId, const char * attrName, std::string& alloc)
     {
-        alloc = "";
-
         size_t len = 0;
         nc_inq_attlen(ncid, varId, attrName, &len);
-        
+
         if(len < 1)
         {
+            alloc.clear();
             return alloc;
         }
 
-        char attr_vals[NC_MAX_NAME + 1];
-        memset(attr_vals, 0, NC_MAX_NAME + 1);
+        alloc.resize(len);
+        memset(&alloc[0], 0, len);
 
         // Now look through this variable for the attribute
-        if(nc_get_att_text(ncid, varId, attrName, attr_vals) != NC_NOERR)
-        {
-            return alloc;
-        }
+        nc_get_att_text(ncid, varId, attrName, &alloc[0]);
 
-        alloc = std::string(attr_vals);
         return alloc;
     }
 

programming_language: C++
CVE-2022-40673 (published 2022-09-14T11:15Z)

KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/JonMagon/KDiskMark
commit_details: repo_url: https://github.com/JonMagon/KDiskMark
author: JonMagon
author_date: 2022-09-04 21:54:41+03:00
msg: Add missing authorization checking in Helper::flushPageCache()
repository: repo_url: https://github.com/JonMagon/KDiskMark
repo_name: JonMagon/KDiskMark
description: A simple open-source disk benchmark tool for Linux distros
repo_language: C++
owner: JonMagon
file_changes: filename: helper.cpp
change_type: ModificationType.MODIFY
diff: @@ -190,6 +190,10 @@ void Helper::startBenchmarkTest(int measuringTime, int fileSize, int randomReadP
 
 QVariantMap Helper::flushPageCache()
 {
+    if (!isCallerAuthorized()) {
+        return {};
+    }
+
     QVariantMap reply;
     reply[QStringLiteral("success")] = true;
 

programming_language: C++
CVE-2021-29578 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalAvgPoolGrad` is vulnerable to a heap buffer overflow. The implementation(https://github.com/tensorflow/tensorflow/blob/dcba796a28364d6d7f003f6fe733d82726dda713/tensorflow/core/kernels/fractional_avg_pool_op.cc#L216) fails to validate that the pooling sequence arguments have enough elements as required by the `out_backprop` tensor shape. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-05-06 14:02:47-07:00
msg: Validate inputs of `FractionalAvgPoolGrad`.

PiperOrigin-RevId: 372420640
Change-Id: Icc583928e6cdc3062e12498e4d2337a8fe3da016
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: fractional_avg_pool_op.cc
change_type: ModificationType.MODIFY
diff: @@ -250,6 +250,19 @@ class FractionalAvgPoolGradOp : public OpKernel {
     const int64 out_cols = out_backprop.dim_size(2);
     const int64 out_depth = out_backprop.dim_size(3);
 
+    OP_REQUIRES(context, row_seq_tensor.NumElements() > out_rows,
+                errors::InvalidArgument("Given out_backprop shape ",
+                                        out_backprop.shape().DebugString(),
+                                        ", row_seq_tensor must have at least ",
+                                        out_rows + 1, " elements, but got ",
+                                        row_seq_tensor.NumElements()));
+    OP_REQUIRES(context, col_seq_tensor.NumElements() > out_cols,
+                errors::InvalidArgument("Given out_backprop shape ",
+                                        out_backprop.shape().DebugString(),
+                                        ", col_seq_tensor must have at least ",
+                                        out_cols + 1, " elements, but got ",
+                                        col_seq_tensor.NumElements()));
+
     auto row_seq_tensor_flat = row_seq_tensor.flat<int64>();
     auto col_seq_tensor_flat = col_seq_tensor.flat<int64>();
     auto orig_input_tensor_shape_flat = orig_input_tensor_shape.flat<int64>();

programming_language: C++
CVE-2019-19043 (published 2019-11-18T06:15Z)

A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-25 10:48:30-05:00
msg: i40e: prevent memory leak in i40e_setup_macvlans

In i40e_setup_macvlans if i40e_setup_channel fails the allocated memory
for ch should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: i40e_main.c
change_type: ModificationType.MODIFY
diff: @@ -7187,6 +7187,7 @@ static int i40e_setup_macvlans(struct i40e_vsi *vsi, u16 macvlan_cnt, u16 qcnt,
 		ch->num_queue_pairs = qcnt;
 		if (!i40e_setup_channel(pf, vsi, ch)) {
 			ret = -EINVAL;
+			kfree(ch);
 			goto err_free;
 		}
 		ch->parent_vsi = vsi;

programming_language: C
CVE-2018-13406 (published 2018-07-06T14:29Z)

An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Kees Cook
author_date: 2018-05-11 18:24:12+10:00
msg: video: uvesafb: Fix integer overflow in allocation

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: uvesafb.c
change_type: ModificationType.MODIFY
diff: @@ -1044,7 +1044,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
 		    info->cmap.len || cmap->start < info->cmap.start)
 			return -EINVAL;
 
-		entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+		entries = kmalloc_array(cmap->len, sizeof(*entries),
+					GFP_KERNEL);
 		if (!entries)
 			return -ENOMEM;
 

programming_language: C