starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-7381 (published 2020-02-12T15:15Z)

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/mytrile/node-libnotify
commit_details: repo_url: https://github.com/mytrile/node-libnotify
author: Dimitar Kostov
author_date: 2013-05-14 12:46:34-07:00
msg: Merge pull request #4 from nealpoole/exec-fix

Replacing call to exec with execFile.
repository: repo_url: https://github.com/mytrile/node-libnotify
repo_name: mytrile/node-libnotify
description: libnotify for node.js
repo_language: JavaScript
owner: mytrile
CVE-2013-1425 (published 2019-11-07T21:15Z)

ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/elmar/ldap-git-backup
commit_details: repo_url: https://github.com/elmar/ldap-git-backup
author: Elmar S. Heeb
author_date: 2013-01-28 19:03:51+00:00
msg: set default permission 0700 for backup directory

fixes CVE-2013-1425 (local information disclosure)
repository: repo_url: https://github.com/elmar/ldap-git-backup
repo_name: elmar/ldap-git-backup
description: backup LDAP in a Git repository
repo_language: Perl
owner: elmar
file_changes: filename: README.mdown
change_type: ModificationType.MODIFY
diff: @@ -115,3 +115,4 @@ Over time various people contributed with discussions, ideas, code, and bug repo
 - Axel Beckert <abe@debian.org> (co-maintainer)
 - Florian Ernst <florian\_ernst@gmx.net>
 - Bart Martens <bartm@debian.org>
+- Hans Spaans <hans.spaans@nexit.nl>

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 AC_PREREQ([2.67])dnl require version in Debian squeeze (or higher)
 AC_INIT(
     [LDAP Git Backup],
-    [1.0.3],
+    [1.0.4],
     [elmar@heebs.ch],
     [ldap-git-backup],
     [https://github.com/elmar/ldap-git-backup]

programming_language: PowerShell
filename: changelog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,11 @@
+ldap-git-backup (1.0.4-1) unstable; urgency=low
+
+  * create backup directory with default mode of 0700
+    fixes CVE-2013-1425 (local information disclosure)
+    Thanks to Hans Spaans <hans.spaans@nexit.nl>
+
+ -- Elmar S. Heeb <elmar@heebs.ch>  Mon, 28 Jan 2013 19:05:13 +0000
+
 ldap-git-backup (1.0.3-2) unstable; urgency=low
 
   * clean up of Depends and Build-Depends

programming_language: Markdown
filename: ldap-git-backup.in
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ sub main {
     }
 
     my $ldif_aref = LDAP::Utils::read_ldif($ldif_cmd);
-    make_path($backup_dir);
+    make_path($backup_dir, {mode => 0700});
     chdir($backup_dir);
     Git::command('init');
     my $repo = Git->repository(Directory => $backup_dir);

programming_language: Perl
filename: 030_git-from-scratch.t.in
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,9 @@ ok(
     'first backup should run'
 );
 ok( (-d $backup_dir), 'backup directory should have been created' );
+my $mode = ((stat($backup_dir))[2]) & 0777; # mask only permission part of mode
+$mode = sprintf("%#o", $mode); # string in octal to help readability of assertion
+is( $mode, '0700', 'new backup directory should be created with mode 0700 (rwx------)' );
 ok( (-d "$backup_dir/.git"), 'backup directory should be a GIT repository now');
 
 check_directory_list($backup_dir, qw(

programming_language: Perl
CVE-2023-0316 (published 2023-01-16T01:15Z)

Path Traversal: '\\..\\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-29
cwe_name: Path Traversal: '\..\filename'
description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
extended_description: 
            This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
            This is similar to CWE-25, except using "\" instead of "/". Sometimes a program checks for "..\" at the beginning of the input, so a "\..\" can bypass that check. It is also useful for bypassing path traversal protection schemes that only assume that the "/" separator is valid.
         
         

Fix information:
repo_url: https://github.com/froxlor/froxlor
commit_details: repo_url: https://github.com/froxlor/froxlor
author: Michael Kaufmann
author_date: 2022-12-30 14:39:32+01:00
msg: validate image data/filename when importing

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
repository: repo_url: https://github.com/froxlor/froxlor
repo_name: froxlor/Froxlor
description: The server administration software for your needs - The official Froxlor development Git repository
repo_language: PHP
owner: froxlor
file_changes: filename: SImExporter.php
change_type: ModificationType.MODIFY
diff: @@ -157,7 +157,39 @@ class SImExporter
 						}
 					}
 
-					file_put_contents(Froxlor::getInstallDir() . '/' . explode('?', $_data[$index_split[0] . '.' . $index_split[1]], 2)[0], base64_decode($value));
+					$img_data = base64_decode($value);
+					$img_filename = Froxlor::getInstallDir() . '/' . str_replace('../', '', explode('?', $_data[$index_split[0] . '.' . $index_split[1]], 2)[0]);
+
+					file_put_contents($img_filename, $img_data);
+
+					if (function_exists('finfo_open')) {
+						$finfo = finfo_open(FILEINFO_MIME_TYPE);
+						$mimetype = finfo_file($finfo, $img_filename);
+						finfo_close($finfo);
+					} else {
+						$mimetype = mime_content_type($img_filename);
+					}
+					if (empty($mimetype)) {
+						$mimetype = 'application/octet-stream';
+					}
+					if (!in_array($mimetype, ['image/jpeg', 'image/jpg', 'image/png', 'image/gif'])) {
+						@unlink($img_filename);
+						throw new Exception("Uploaded file is not a valid image");
+					}
+
+					$spl = explode('.', $img_filename);
+					$file_extension = strtolower(array_pop($spl));
+					unset($spl);
+
+					if (!in_array($file_extension, [
+						'jpeg',
+						'jpg',
+						'png',
+						'gif'
+					])) {
+						@unlink($img_filename);
+						throw new Exception("Invalid file-extension, use one of: jpeg, jpg, png, gif");
+					}
 					continue;
 				}
 

programming_language: PHP
CVE-2021-4193 (published 2021-12-31T16:15Z)

vim is vulnerable to Out-of-bounds Read

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-12-30 15:29:18+00:00
msg: patch 8.2.3950: going beyond the end of the line with /\%V

Problem:    Going beyond the end of the line with /\%V.
Solution:   Check for valid column in getvcol().
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: charset.c
change_type: ModificationType.MODIFY
diff: @@ -1240,10 +1240,15 @@ getvcol(
 	posptr = NULL;  // continue until the NUL
     else
     {
-	// Special check for an empty line, which can happen on exit, when
-	// ml_get_buf() always returns an empty string.
-	if (*ptr == NUL)
-	    pos->col = 0;
+	colnr_T i;
+
+	// In a few cases the position can be beyond the end of the line.
+	for (i = 0; i < pos->col; ++i)
+	    if (ptr[i] == NUL)
+	    {
+		pos->col = i;
+		break;
+	    }
 	posptr = ptr + pos->col;
 	if (has_mbyte)
 	    // always start on the first byte

programming_language: C
filename: test_regexp_latin.vim
change_type: ModificationType.MODIFY
diff: @@ -1053,4 +1053,12 @@ func Test_using_visual_position()
   bwipe!
 endfunc
 
+func Test_using_invalid_visual_position()
+  " this was going beyond the end of the line
+  new
+  exe "norm 0o000\<Esc>0\<C-V>$s0"
+  /\%V
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -749,6 +749,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3950,
 /**/
     3949,
 /**/

programming_language: Ruby
CVE-2021-4254 (published 2022-12-18T22:15Z)

A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument notice.notice.text leads to cross site scripting. The attack can be launched remotely. The name of the patch is aa300555343c1c081951fcb68bfb6852fbba7451. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216211.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-707
cwe_name: Improper Neutralization
description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
extended_description: 
            If a message is malformed, it may cause the message to be incorrectly interpreted.
            Neutralization is an abstract term for any technique that ensures that input (and output) conforms with expectations and is "safe."  This can be done by:
	    
	      checking that the input/output is already "safe" (e.g. validation)
	      transformation of the input/output to be "safe" using techniques such as filtering, encoding/decoding, escaping/unescaping, quoting/unquoting, or canonicalization
	      preventing the input/output from being directly provided by an attacker (e.g. "indirect selection" that maps externally-provided values to internally-controlled values)
	      preventing the input/output from being processed at all
	    
            This weakness typically applies in cases where the product prepares a control message that another process must act on, such as a command or query, and malicious input that was intended as data, can enter the control plane instead. However, this weakness also applies to more general cases where there are not always control implications.
         
         

Fix information:
repo_url: https://github.com/ctrlo/lenio
commit_details: repo_url: https://github.com/ctrlo/lenio
author: Andy Beverley
author_date: 2021-02-08 20:14:25+00:00
msg: Fix XSS in notices
repository: repo_url: https://github.com/ctrlo/lenio
repo_name: ctrlo/lenio
description: Facilities management system
repo_language: Perl
owner: ctrlo
file_changes: filename: main.tt
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@
     [% FOR notice IN login.login_notices %]
         <div class="alert alert-info alert-dismissable" data-someid="[% notice.id %]">
         <button id="my-alert" type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
-        [% notice.notice.text %]
+        [% notice.notice.text | html %]
         </div>
     [% END %]
 

programming_language: HTML
CVE-2013-2635 (published 2013-03-22T11:59Z)

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mathias Krause
author_date: 2013-03-09 05:52:20+00:00
msg: rtnl: fix info leak on RTM_GETLINK request for VF devices

Initialize the mac address buffer with 0 as the driver specific function
will probably not fill the whole buffer. In fact, all in-kernel drivers
fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
bytes. Therefore we currently leak 26 bytes of stack memory to userland
via the netlink interface.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: rtnetlink.c
change_type: ModificationType.MODIFY
diff: @@ -979,6 +979,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
 			 * report anything.
 			 */
 			ivi.spoofchk = -1;
+			memset(ivi.mac, 0, sizeof(ivi.mac));
 			if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
 				break;
 			vf_mac.vf =

programming_language: C
CVE-2020-36569 (published 2022-12-27T22:15Z)

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/nanobox-io/golang-nanoauth
commit_details: repo_url: https://github.com/nanobox-io/golang-nanoauth
author: Tyler Flint
author_date: 2020-01-31 08:10:40-05:00
msg: Merge pull request #5 from bouk/constant-time-compare

Small security fixes
repository: repo_url: https://github.com/nanobox-io/golang-nanoauth
repo_name: nanobox-io/golang-nanoauth
description: Simple auth layer
repo_language: Go
owner: nanobox-io
CVE-2021-31800 (published 2021-05-05T11:15Z)

Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/SecureAuthCorp/impacket
commit_details: repo_url: https://github.com/SecureAuthCorp/impacket
author: 0xdeaddood
author_date: 2021-05-03 12:43:02-03:00
msg: Merge pull request #1066 from omriinbar/master

Fix Path Traversal vulnerabilities by checking path prefix against in…
repository: repo_url: https://github.com/SecureAuthCorp/impacket
repo_name: fortra/impacket
description: Impacket is a collection of Python classes for working with network protocols.
repo_language: Python
owner: SecureAuthCorp
CVE-2021-37635 (published 2021-08-12T21:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_reduce_op.cc#L217-L228) fails to validate that each reduction group does not overflow and that each corresponding index does not point to outside the bounds of the input tensor. We have patched the issue in GitHub commit 87158f43f05f2720a374f3e6d22a7aaa3a33f750. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-07-30 21:11:18-07:00
msg: Prevent heap OOB in sparse reduction ops.

PiperOrigin-RevId: 387934524
Change-Id: I894aa30f1e454f09b471d565b4a325da49322c1a
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: sparse_reduce_op.cc
change_type: ModificationType.MODIFY
diff: @@ -219,7 +219,20 @@ class SparseReduceOp : public OpKernel {
     sp.Reorder<T>(reduction.reorder_dims);
     for (const auto &g : sp.group(reduction.group_by_dims)) {
       Op::template Run<T>(ctx, reduced_val, g.template values<T>());
+      OP_REQUIRES(ctx,
+                  output_strides.empty() ||
+                  (g.group().size() == output_strides.size()),
+                  errors::Internal(
+                      "Expected group size and output_strides size to match",
+                      ", but got ", g.group().size(), " and ",
+                      output_strides.size()));
       const int64_t idx = CoordinatesToFlatIndex(g.group(), output_strides);
+      OP_REQUIRES(ctx,
+                  idx >= 0 && idx < out_flat.size(),
+                  errors::Internal(
+                      "Obtained a write index of ", idx,
+                      " which is outside of bounds of [0, ",
+                      out_flat.size(), ")"));
       out_flat(idx) = reduced_val();
       VLOG(2) << "coords: " << absl::StrJoin(g.group(), ",")
               << "; idx: " << idx << "; group " << Op::Name() << ": "

programming_language: C++