starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-48656 (published 2023-11-17T05:15Z)

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Luciano Righetti
author_date: 2023-09-11 12:35:30+02:00
msg: fix: fixed invalid ordering errors
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: AppModel.php
change_type: ModificationType.MODIFY
diff: @@ -3989,4 +3989,32 @@ class AppModel extends Model
         }
         return $_SERVER['REMOTE_ADDR'] ?? null;
     }
+
+    public function find($type = 'first', $query = array()) {
+        if (!empty($query['order']) && $this->validOrderClause($query['order']) === false) {
+            throw new InvalidArgumentException('Invalid order clause');
+        }
+
+        return parent::find($type, $query);
+    }
+
+    private function validOrderClause($order){
+        $pattern = '/^[\w\_\-\.\(\) ]+$/';
+        if(is_string($order) && preg_match($pattern, $order)){
+            return true;
+        }
+
+        if (is_array($order)) {
+            foreach ($order as $key => $value) {
+                if (is_string($key) && is_string($value) && preg_match($pattern, $key) && in_array(strtolower($value), ['asc', 'desc'])) {
+                    return true;
+                }
+                if(is_numeric($key) && is_string($value) && preg_match($pattern, $value)){
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
 }

programming_language: PHP
CVE-2017-16877 (published 2017-11-17T17:29Z)

ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/vercel/next.js
commit_details: repo_url: https://github.com/vercel/next.js
author: Arunoda Susiripala
author_date: 2017-06-01 06:16:58+05:30
msg: Merge branch 'fix-dir-traversal-error'
repository: repo_url: https://github.com/vercel/next.js
repo_name: vercel/next.js
description: The React Framework
repo_language: JavaScript
owner: vercel
CVE-2014-3478 (published 2014-07-09T11:07Z)

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/file/file
commit_details: repo_url: https://github.com/file/file
author: Christos Zoulas
author_date: 2014-06-04 17:36:34+00:00
msg: Correctly compute the truncated pascal string size (Francisco Alonso and
Jan Kaluza at RedHat)
repository: repo_url: https://github.com/file/file
repo_name: file/file
description: Read-only mirror of file CVS repository, updated every half hour. NOTE: do not make pull requests here, nor comment any commits, submit them usual way to bug tracker or to the mailing list. Maintainer(s) are not tracking  this git mirror.
repo_language: C
owner: file
file_changes: filename: softmagic.c
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -940,10 +940,18 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';

programming_language: C
CVE-2024-28184 (published 2024-03-09T01:15Z)

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Kozea/WeasyPrint
commit_details: repo_url: https://github.com/Kozea/WeasyPrint
author: Guillaume Ayoub
author_date: 2024-03-07 22:51:34+01:00
msg: Use document’s url_fetcher for attachments

Also force HTML attachments to be detected as URLs so that url_fetcher is
always used.
repository: repo_url: https://github.com/Kozea/WeasyPrint
repo_name: Kozea/WeasyPrint
description: The awesome document factory
repo_language: Python
owner: Kozea
file_changes: filename: html.py
change_type: ModificationType.MODIFY
diff: @@ -281,7 +281,9 @@ def get_html_metadata(html):
             if url is None:
                 LOGGER.error('Missing href in <link rel="attachment">')
             else:
-                attachment = Attachment(url=url, description=attachment_title)
+                attachment = Attachment(
+                    url=url, description=attachment_title,
+                    url_fetcher=html.url_fetcher)
                 attachments.append(attachment)
     return {
         'title': title,

programming_language: Python
filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -249,7 +249,8 @@ def generate_pdf(document, target, zoom, **options):
     if options['attachments']:
         for attachment in options['attachments']:
             if not isinstance(attachment, Attachment):
-                attachment = Attachment(attachment)
+                attachment = Attachment(
+                    attachment, url_fetcher=document.url_fetcher)
             attachments.append(attachment)
     pdf_attachments = []
     for attachment in attachments:

programming_language: Python
filename: anchors.py
change_type: ModificationType.MODIFY
diff: @@ -252,8 +252,10 @@ def add_annotations(links, matrix, document, pdf, page, annot_files, compress):
             # TODO: Use the title attribute as description. The comment
             # above about multiple regions won't always be correct, because
             # two links might have the same href, but different titles.
+            attachment = Attachment(
+                url=annot_target, url_fetcher=document.url_fetcher)
             annot_files[annot_target] = write_pdf_attachment(
-                pdf, Attachment(annot_target), compress)
+                pdf, attachment, compress)
         annot_file = annot_files[annot_target]
         if annot_file is None:
             continue

programming_language: Python
CVE-2024-39691 (published 2024-07-05T19:15Z)

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/matrix-org/matrix-appservice-irc
commit_details: repo_url: https://github.com/matrix-org/matrix-appservice-irc
author: Tadeusz Sośnierz
author_date: 2024-05-21 11:16:52+02:00
msg: Don't use origin_server_ts when tracking joins, use bridge-time instead (#1804)

* Don't use origin_server_ts when tracking joins, use bridge-time instead

* Changelog
repository: repo_url: https://github.com/matrix-org/matrix-appservice-irc
repo_name: matrix-org/matrix-appservice-irc
description: Node.js IRC bridge for Matrix
repo_language: TypeScript
owner: matrix-org
file_changes: filename: 1804.misc
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+Don't use origin_server_ts when tracking joins, use bridge-time instead.

programming_language: SQL
filename: MatrixHandler.ts
change_type: ModificationType.MODIFY
diff: @@ -414,7 +414,7 @@ export class MatrixHandler {
      */
     private _onMemberEvent(req: BridgeRequest, event: OnMemberEventData) {
         if (event.content.membership === 'join') {
-            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, event.origin_server_ts ?? Date.now());
+            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, Date.now());
         }
         else {
             this.memberJoinTs.delete(`${event.room_id}/${event.state_key}`);

programming_language: TypeScript
CVE-2017-9454 (published 2017-08-18T14:29Z)

Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/resiprocate/resiprocate
commit_details: repo_url: https://github.com/resiprocate/resiprocate
author: Gregor Jasny
author_date: 2017-06-06 17:49:32+02:00
msg: ares: Prevent buffer overlow in ares_parse_a_reply (CVE-2017-9454)

This buffer overflow is in the embedded copy of ares that will be
used unless the external alternative c-ares is used by specifying
the configure argument --with-c-ares.

It has been found with LibFuzzer from the LLVM project.
repository: repo_url: https://github.com/resiprocate/resiprocate
repo_name: resiprocate/resiprocate
description: C++ implementation of SIP, ICE, TURN and related protocols.
repo_language: C++
owner: resiprocate
file_changes: filename: ares_parse_a_reply.c
change_type: ModificationType.MODIFY
diff: @@ -103,6 +103,12 @@ int ares_parse_a_reply(const unsigned char *abuf, int alen,
       rr_class = DNS_RR_CLASS(aptr);
       rr_len = DNS_RR_LEN(aptr);
       aptr += RRFIXEDSZ;
+      if (aptr + rr_len > abuf + alen)
+	{
+	  free(rr_name);
+	  status = ARES_EBADRESP;
+	  break;
+	}
 
       if (rr_class == C_IN && rr_type == T_A
 	  && rr_len == sizeof(struct in_addr)

programming_language: C
CVE-2019-3559 (published 2019-05-06T16:29Z)

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/facebook/fbthrift
commit_details: repo_url: https://github.com/facebook/fbthrift
author: Stepan Palamarchuk
author_date: 2019-02-14 13:40:41-08:00
msg: Throw on bad types during skipping data

Summary:
The current code silently returns on bad types. In case when we have an invalid data, we may get a container of a large size with a bad type, this would lead to us running long loop doing nothing (though we already can say that the data is invalid).

The new code would throw an exception as soon as we try to skip a value of invalid type.

Fixes CVE-2019-3552

Reviewed By: stevegury

Differential Revision: D13892370

fbshipit-source-id: 582c81f90cf40c105383083cb38815816140e3ad
repository: repo_url: https://github.com/facebook/fbthrift
repo_name: facebook/fbthrift
description: Facebook's branch of Apache Thrift, including a new C++ server.
repo_language: C++
owner: facebook
file_changes: filename: TProtocolUtil.java
change_type: ModificationType.MODIFY
diff: @@ -166,7 +166,10 @@ public class TProtocolUtil {
         break;
       }
     default:
-      break;
+      {
+        throw new TProtocolException(
+              TProtocolException.INVALID_DATA, "Invalid type encountered during skipping: " + type);
+      }
     }
   }
 

programming_language: Java
CVE-2019-15541 (published 2019-08-26T12:15Z)

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/ctz/rustls
commit_details: repo_url: https://github.com/ctz/rustls
author: Joseph Birr-Pixton
author_date: 2019-08-10 09:47:06+01:00
msg: tlsserver: fix loop when client will never be writable
repository: repo_url: https://github.com/ctz/rustls
repo_name: rustls/rustls
description: A modern TLS library in Rust
repo_language: Rust
owner: ctz
file_changes: filename: tlsserver.rs
change_type: ModificationType.MODIFY
diff: @@ -179,7 +179,7 @@ impl Connection {
             self.do_tls_write_and_handle_error();
         }
 
-        if self.closing && !self.tls_session.wants_write() {
+        if self.closing {
             let _ = self.socket.shutdown(Shutdown::Both);
             self.close_back();
             self.closed = true;

programming_language: Rust
CVE-2024-23822 (published 2024-01-29T16:15Z)

Thruk is a multibackend monitoring webinterface.  Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/sni/Thruk
commit_details: repo_url: https://github.com/sni/Thruk
author: Sven Nierlein
author_date: 2024-01-26 09:25:55+01:00
msg: panorama: validate input folder for image uploads
repository: repo_url: https://github.com/sni/Thruk
repo_name: sni/Thruk
description: Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API.
repo_language: Perl
owner: sni
file_changes: filename: panorama.pm
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@ use warnings;
 use strict;
 use Carp qw/confess/;
 use Cpanel::JSON::XS qw/decode_json/;
+use Cwd ();
 use Data::Dumper qw/Dumper/;
 use Encode qw(encode_utf8);
 use File::Copy qw/move copy/;
@@ -732,7 +733,14 @@ sub _task_upload {
     }
 
     my $upload = $c->req->uploads->{$type};
-    my $folder = $c->stash->{'usercontent_folder'}.'/'.$location;
+    my $folder = Cwd::abs_path($c->stash->{'usercontent_folder'}.'/'.$location);
+
+    # make sure requested folder is below the usercontent folder
+    if(CORE::index(Cwd::abs_path($c->stash->{'usercontent_folder'}), $folder) != 0) {
+        # must be text/html result, otherwise extjs form result handler dies
+        $c->stash->{text} = Thruk::Utils::Filter::json_encode({ 'msg' => 'Fileupload contains illegal folder.', success => Cpanel::JSON::XS::false });
+        return;
+    }
 
     if(!-w $folder.'/.') {
         # must be text/html result, otherwise extjs form result handler dies

programming_language: Perl
CVE-2022-41922 (published 2022-11-23T18:15Z)

`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/yiisoft/yii
commit_details: repo_url: https://github.com/yiisoft/yii
author: Marco van 't Wout
author_date: 2022-11-21 14:48:12+01:00
msg: Merge pull request from GHSA-442f-wcwq-fpcf

Fix for CVE-2022-41922
repository: repo_url: https://github.com/yiisoft/yii
repo_name: yiisoft/yii
description: Yii PHP Framework 1.1.x
repo_language: PHP
owner: yiisoft