starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-46741 (published 2024-01-03T17:15Z)

CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not have permissions for. For example, an attacker that has succesfully retrieved a secret key from the logs can delete blogs from the blob store. The attacker can either be an internal user with limited privileges to read the log, or they can be an external user who has escalated privileges sufficiently to access the logs. The vulnerability has been patched in v3.3.1. There is no other mitigation than upgrading.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cubefs/cubefs
commit_details: repo_url: https://github.com/cubefs/cubefs
author: slasher
author_date: 2023-10-20 10:42:08+08:00
msg: fix(security): leaks magic secret key when starting blobstore access service

see more in cubefs advisories:
https://github.com/cubefs/cubefs/security/advisories/GHSA-8h2x-gr2c-c275

Signed-off-by: slasher <shenjie1@oppo.com>
repository: repo_url: https://github.com/cubefs/cubefs
repo_name: cubefs/cubefs
description: cloud-native distributed storage
repo_language: Go
owner: cubefs
file_changes: filename: server.go
change_type: ModificationType.MODIFY
diff: @@ -78,8 +78,6 @@ func initWithRegionMagic(regionMagic string) {
 		log.Warn("no region magic setting, using default secret keys for checksum")
 		return
 	}
-
-	log.Info("using magic secret keys for checksum with:", regionMagic)
 	b := sha1.Sum([]byte(regionMagic))
 	initTokenSecret(b[:8])
 	initLocationSecret(b[:8])

programming_language: Go
CVE-2021-37706 (published 2021-12-22T18:15Z)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Severity: HIGH
CVSS v2 base score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://github.com/pjsip/pjproject
commit_details: repo_url: https://github.com/pjsip/pjproject
author: sauwming
author_date: 2021-08-10 11:53:25+08:00
msg: Merge pull request from GHSA-2qpg-f6wf-w984
repository: repo_url: https://github.com/pjsip/pjproject
repo_name: pjsip/pjproject
description: PJSIP project
repo_language: C
owner: pjsip
file_changes: filename: stun_msg.c
change_type: ModificationType.MODIFY
diff: @@ -1763,6 +1763,9 @@ static pj_status_t decode_errcode_attr(pj_pool_t *pool,
     /* Get pointer to the string in the message */
     value.ptr = ((char*)buf + ATTR_HDR_LEN + 4);
     value.slen = attr->hdr.length - 4;
+    /* Make sure the length is never negative */
+    if (value.slen < 0)
+    	value.slen = 0;
 
     /* Copy the string to the attribute */
     pj_strdup(pool, &attr->reason, &value);

programming_language: C
CVE-2024-28187 (published 2024-03-11T20:15Z)

SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/inunosinsi/soycms
commit_details: repo_url: https://github.com/inunosinsi/soycms
author: inunosinsi
author_date: 2024-02-28 09:56:12+09:00
msg: [Fix]OS Command Injection via file upload. https://github.com/inunosinsi/soycms/issues/21
repository: repo_url: https://github.com/inunosinsi/soycms
repo_name: inunosinsi/soycms
description: SOY CMS PHP8用
repo_language: PHP
owner: inunosinsi
file_changes: filename: SearchAction.class.php
change_type: ModificationType.MODIFY
diff: @@ -58,10 +58,11 @@ class SearchAction extends SOY2Action{
 			foreach(array("title","content","more") as $column){
 				$freeword = array();
 				foreach($keywords as $keyword){
+					$keyword = trim($keyword);
 
 					$bind_key = ':freeword'.$keywordCounts;
 
-					if($keyword[0] == "-"){
+					if(strlen($keyword) >= 1 && $keyword[0] == "-"){
 						$keyword = substr($keyword,1);
 						$freeword[] = 'Entry.'.$column." not like ".$bind_key."";
 					}else{

programming_language: PHP
filename: UploadFileAction.class.php
change_type: ModificationType.MODIFY
diff: @@ -163,8 +163,8 @@ class UploadFileAction extends SOY2Action{
 					switch($ext){
 						case "jpeg":
 							exec("jpegoptim -V", $out);
-							if(isset($out) && count($out)){
-								exec("jpegoptim --strip-all " . $filepath);
+							if(is_array($out) && count($out)){
+								exec("jpegoptim --strip-all " . escapeshellarg($filepath));
 							}
 							break;
 					}

programming_language: PHP
CVE-2023-41910 (published 2023-09-05T07:15Z)

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/lldpd/lldpd
commit_details: repo_url: https://github.com/lldpd/lldpd
author: Vincent Bernat
author_date: 2023-04-12 07:38:31+02:00
msg: daemon: fix read overflow when parsing CDP addresses
repository: repo_url: https://github.com/lldpd/lldpd
repo_name: lldpd/lldpd
description: implementation of IEEE 802.1ab (LLDP)
repo_language: C
owner: lldpd
file_changes: filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+lldpd (1.0.17)
+ * Fix:
+   + Read overflow when parsing CDP addresses. Thanks to Matteo Memelli.
+
 lldpd (1.0.16)
  * Fix:
    + Do not use 00:00:00:00:00:00 as chassis ID.

programming_language: Markdown
filename: cdp.c
change_type: ModificationType.MODIFY
diff: @@ -466,6 +466,7 @@ cdp_decode(struct lldpd *cfg, char *frame, int s, struct lldpd_hardware *hardwar
 					goto malformed;
 				}
 				PEEK_DISCARD(address_len);
+				addresses_len -= address_len;
 				(void)PEEK_SAVE(pos_next_address);
 				/* Next, we go back and try to extract
 				   IPv4 address */

programming_language: C
CVE-2013-4789 (published 2013-08-09T21:55Z)

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Cotonti/Cotonti
commit_details: repo_url: https://github.com/Cotonti/Cotonti
author: Vladimir Sibirov
author_date: 2013-07-17 22:49:02+04:00
msg: Fixed SQL injection vulnerability in RSS module
repository: repo_url: https://github.com/Cotonti/Cotonti
repo_name: Cotonti/Cotonti
description: Fast, reliable and flexible PHP CMF/CMS
repo_language: PHP
owner: Cotonti
file_changes: filename: rss.php
change_type: ModificationType.MODIFY
diff: @@ -199,7 +199,7 @@
 {
 	require_once cot_incfile('page', 'module');
 
-	if (!empty($c))
+	if (!empty($c) && isset($structure['page'][$c]))
 	{
 		$mtch = $structure['page'][$c]['path'].".";
 		$mtchlen = mb_strlen($mtch);

programming_language: PHP
CVE-2016-2070 (published 2016-05-02T10:59Z)

The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Yuchung Cheng
author_date: 2016-01-06 12:42:38-08:00
msg: tcp: fix zero cwnd in tcp_cwnd_reduction

Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode
conditionally") introduced a bug that cwnd may become 0 when both
inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
to a div-by-zero if the connection starts another cwnd reduction
phase by setting tp->prior_cwnd to the current cwnd (0) in
tcp_init_cwnd_reduction().

To prevent this we skip PRR operation when nothing is acked or
sacked. Then cwnd must be positive in all cases as long as ssthresh
is positive:

1) The proportional reduction mode
   inflight > ssthresh > 0

2) The reduction bound mode
  a) inflight == ssthresh > 0

  b) inflight < ssthresh
     sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh

Therefore in all cases inflight and sndcnt can not both be 0.
We check invalid tp->prior_cwnd to avoid potential div0 bugs.

In reality this bug is triggered only with a sequence of less common
events.  For example, the connection is terminating an ECN-triggered
cwnd reduction with an inflight 0, then it receives reordered/old
ACKs or DSACKs from prior transmission (which acks nothing). Or the
connection is in fast recovery stage that marks everything lost,
but fails to retransmit due to local issues, then receives data
packets from other end which acks nothing.

Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally")
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: tcp_input.c
change_type: ModificationType.MODIFY
diff: @@ -2478,6 +2478,9 @@ static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
 	int newly_acked_sacked = prior_unsacked -
 				 (tp->packets_out - tp->sacked_out);
 
+	if (newly_acked_sacked <= 0 || WARN_ON_ONCE(!tp->prior_cwnd))
+		return;
+
 	tp->prr_delivered += newly_acked_sacked;
 	if (delta < 0) {
 		u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +

programming_language: C
CVE-2021-3973 (published 2021-11-19T12:15Z)

vim is vulnerable to Heap-based Buffer Overflow

Severity: HIGH
CVSS v2 base score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-11-17 18:00:31+00:00
msg: patch 8.2.3611: crash when using CTRL-W f without finding a file name

Problem:    Crash when using CTRL-W f without finding a file name.
Solution:   Bail out when the file name length is zero.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: findfile.c
change_type: ModificationType.MODIFY
diff: @@ -1735,6 +1735,9 @@ find_file_in_path_option(
     proc->pr_WindowPtr = (APTR)-1L;
 # endif
 
+    if (len == 0)
+	return NULL;
+
     if (first == TRUE)
     {
 	// copy file name into NameBuff, expanding environment variables
@@ -2118,7 +2121,12 @@ find_file_name_in_path(
     int		c;
 # if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
     char_u	*tofree = NULL;
+# endif
 
+    if (len == 0)
+	return NULL;
+
+# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
     if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL)
     {
 	tofree = eval_includeexpr(ptr, len);

programming_language: C
filename: normal.c
change_type: ModificationType.MODIFY
diff: @@ -3881,8 +3881,10 @@ get_visual_text(
 	    *pp = ml_get_pos(&VIsual);
 	    *lenp = curwin->w_cursor.col - VIsual.col + 1;
 	}
-	if (has_mbyte)
-	    // Correct the length to include the whole last character.
+	if (**pp == NUL)
+	    *lenp = 0;
+	if (has_mbyte && *lenp > 0)
+	    // Correct the length to include all bytes of the last character.
 	    *lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
     }
     reset_VIsual_and_resel();

programming_language: C
filename: test_visual.vim
change_type: ModificationType.MODIFY
diff: @@ -1265,6 +1265,14 @@ func Test_visual_block_with_virtualedit()
   call delete('XTest_block')
 endfunc
 
+func Test_visual_block_ctrl_w_f()
+  " Emtpy block selected in new buffer should not result in an error.
+  au! BufNew foo sil norm f
+  edit foo
+
+  au! BufNew
+endfunc
+
 func Test_visual_reselect_with_count()
   " this was causing an illegal memory access
   let lines =<< trim END

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3611,
 /**/
     3610,
 /**/

programming_language: Ruby
CVE-2020-36618 (published 2022-12-19T14:15Z)

A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/FurqanSoftware/node-whois
commit_details: repo_url: https://github.com/FurqanSoftware/node-whois
author: Hajin Lim
author_date: 2021-08-29 14:44:44-03:00
msg: fix(vulnerability): Prototype Pollution Vulnerability (#105)

* fix: prevent prototype injection/derivatives bugs

* fix: indent

* fix: indent
repository: repo_url: https://github.com/FurqanSoftware/node-whois
repo_name: FurqanSoftware/node-whois
description: A simple WHOIS client for NodeJS
repo_language: CoffeeScript
owner: FurqanSoftware
file_changes: filename: index.coffee
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,10 @@ cleanParsingErrors = (string) =>
 	if typeof done is 'undefined' and typeof options is 'function'
 		done = options
 		options = {}
+		
+      if addr == '__proto__'
+              done new Error 'lookup: __proto__ is not allowed to lookup'
+		return
 
 	_.defaults options,
 		follow: 2

programming_language: CoffeeScript
CVE-2023-3229 (published 2023-06-14T06:15Z)

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-840
cwe_name: Business Logic Errors
description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Fix information:
repo_url: https://github.com/fossbilling/fossbilling
commit_details: repo_url: https://github.com/fossbilling/fossbilling
author: Belle Aerni
author_date: 2023-06-11 21:28:00-07:00
msg: Prevent checkouts with disabled products (#1308)
repository: repo_url: https://github.com/fossbilling/fossbilling
repo_name: FOSSBilling/FOSSBilling
description: Empower your hosting business with FOSSBilling, the free and open-source solution for efficient billing and client management.
repo_language: PHP
owner: fossbilling
file_changes: filename: Service.php
change_type: ModificationType.MODIFY
diff: @@ -500,6 +500,11 @@ class Service implements InjectionAwareInterface
         foreach ($this->getCartProducts($cart) as $p) {
             $item = $this->cartProductToApiArray($p);
 
+            $product = $this->di['db']->getExistingModelById('Product', $item['product_id']);
+            if (is_null($product) || $product->status !== 'enabled') {
+                throw new \Box_Exception("Unable to complete order. One or more of the selected products are invalid.");
+            }
+
             /*
              * Convert the domain name to lowercase letters.
              * Using a capital letter in a domain name still points to the same name, so this isn't going to break anything
@@ -514,7 +519,7 @@ class Service implements InjectionAwareInterface
             $item['domain']['transfer_sld'] = (isset($item['domain']['transfer_sld'])) ? strtolower($item['domain']['transfer_sld']) : null;
 
             // Domain TLD must begin with a period - add if not present for owndomain.
-            $item['domain']['owndomain_tld'] = (isset( $item['domain']['owndomain_tld'])) ? (str_contains($item['domain']['owndomain_tld'], '.') ? $item['domain']['owndomain_tld'] : '.' . $item['domain']['owndomain_tld']) : null;
+            $item['domain']['owndomain_tld'] = (isset($item['domain']['owndomain_tld'])) ? (str_contains($item['domain']['owndomain_tld'], '.') ? $item['domain']['owndomain_tld'] : '.' . $item['domain']['owndomain_tld']) : null;
 
             $order = $this->di['db']->dispense('ClientOrder');
             $order->client_id = $client->id;

programming_language: PHP
CVE-2022-41418 (published 2022-12-19T20:15Z)

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/BlogEngine/BlogEngine.NET
commit_details: repo_url: https://github.com/BlogEngine/BlogEngine.NET
author: rxtur
author_date: 2022-05-05 22:09:29-05:00
msg: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues
repository: repo_url: https://github.com/BlogEngine/BlogEngine.NET
repo_name: BlogEngine/BlogEngine.NET
description: Multi-User ASP.NET Blogging Application
repo_language: C#
owner: BlogEngine