starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-31082 (published 2022-06-27T21:15Z)

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi-inventory-plugin
commit_details: repo_url: https://github.com/glpi-project/glpi-inventory-plugin
author: Cédric Anne
author_date: 2022-06-20 09:06:12+02:00
msg: Merge pull request from GHSA-q6m7-h6rj-5wmw
repository: repo_url: https://github.com/glpi-project/glpi-inventory-plugin
repo_name: glpi-project/glpi-inventory-plugin
description: GLPI Inventory plugin
repo_language: PHP
owner: glpi-project
file_changes: filename: deploypackage.class.php
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ if (!defined('GLPI_ROOT')) {
     die("Sorry. You can't access directly to this file");
 }
 
+use Glpi\Toolbox\Sanitizer;
+
 /**
  * Manage the deploy packages.
  */
@@ -1889,11 +1891,11 @@ class PluginGlpiinventoryDeployPackage extends CommonDBTM
 
            //Add the new task
             $input = [
-            'name'                    => '[deploy on demand] ' . $this->fields['name'],
-            'entities_id'             => $computer->fields['entities_id'],
-            'reprepare_if_successful' => 0,
-            'is_deploy_on_demand'     => 1,
-            'is_active'               => 1,
+                'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),
+                'entities_id'             => $computer->fields['entities_id'],
+                'reprepare_if_successful' => 0,
+                'is_deploy_on_demand'     => 1,
+                'is_active'               => 1,
             ];
             $tasks_id = $pfTask->add($input);
 

programming_language: PHP
CVE-2020-26290 (published 2020-12-28T20:15Z)

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.6, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/dexidp/dex
commit_details: repo_url: https://github.com/dexidp/dex
author: Stephen Augustus
author_date: 2020-12-14 03:21:11-05:00
msg: Merge pull request from GHSA-m9hp-7r99-94h5

connector/saml: Validate XML roundtrip data before processing request
repository: repo_url: https://github.com/dexidp/dex
repo_name: dexidp/dex
description: OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
repo_language: Go
owner: dexidp
CVE-2023-37906 (published 2023-07-28T16:15Z)

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Penar Musaraj
author_date: 2023-07-28 12:53:49+01:00
msg: SECURITY: Limit length of edit reason column
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: post.rb
change_type: ModificationType.MODIFY
diff: @@ -64,6 +64,7 @@ class Post < ActiveRecord::Base
   has_many :reviewables, as: :target, dependent: :destroy
 
   validates_with PostValidator, unless: :skip_validation
+  validates :edit_reason, length: { maximum: 1000 }
 
   after_commit :index_search
 

programming_language: Ruby
filename: post_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -61,6 +61,7 @@ RSpec.describe Post do
   end
 
   it { is_expected.to validate_presence_of :raw }
+  it { is_expected.to validate_length_of(:edit_reason).is_at_most(1000) }
 
   # Min/max body lengths, respecting padding
   it { is_expected.not_to allow_value("x").for(:raw) }

programming_language: Ruby
CVE-2014-3181 (published 2014-09-28T10:55Z)

Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jiri Kosina
author_date: 2014-08-27 09:12:24+02:00
msg: HID: magicmouse: sanity check report size in raw_event() callback

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: hid-magicmouse.c
change_type: ModificationType.MODIFY
diff: @@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
 		if (size < 4 || ((size - 4) % 9) != 0)
 			return 0;
 		npoints = (size - 4) / 9;
+		if (npoints > 15) {
+			hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
+					size);
+			return 0;
+		}
 		msc->ntouches = 0;
 		for (ii = 0; ii < npoints; ii++)
 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
 		if (size < 6 || ((size - 6) % 8) != 0)
 			return 0;
 		npoints = (size - 6) / 8;
+		if (npoints > 15) {
+			hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
+					size);
+			return 0;
+		}
 		msc->ntouches = 0;
 		for (ii = 0; ii < npoints; ii++)
 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);

programming_language: C
CVE-2020-26252 (published 2021-01-20T22:15Z)

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/OpenMage/magento-lts
commit_details: repo_url: https://github.com/OpenMage/magento-lts
author: Mark Lewis
author_date: 2021-01-19 10:17:49-05:00
msg: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability
repository: repo_url: https://github.com/OpenMage/magento-lts
repo_name: OpenMage/magento-lts
description: Official OpenMage LTS codebase | Migrate easily from Magento Community Edition in minutes! Download the source code for free or contribute to OpenMage LTS | Security vulnerability patches, bug fixes, performance improvements and more.
repo_language: PHP
owner: OpenMage
CVE-2022-0534 (published 2022-02-09T23:15Z)

A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2022-01-07 18:21:53-05:00
msg: Block GIF images with a code size > 12 (Issue #463)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: image.cxx
change_type: ModificationType.MODIFY
diff: @@ -305,6 +305,12 @@ gif_read_image(FILE       *fp,		/* I - Input file */
   pass      = 0;
   code_size = (uchar)getc(fp);
 
+  if (code_size > 12)
+  {
+    progress_error(HD_ERROR_READ_ERROR, "Bad GIF file \"%s\" - invalid code size %d.", img->filename, code_size);
+    return (-1);
+  }
+
   if (gif_read_lzw(fp, 1, code_size) < 0)
     return (-1);
 
@@ -432,7 +438,7 @@ gif_read_lzw(FILE *fp,			/* I - File to read from */
   if (sp > stack)
     return (*--sp);
 
-  while ((code = gif_get_code (fp, code_size, 0)) >= 0)
+  while ((code = gif_get_code(fp, code_size, 0)) >= 0)
   {
     if (code == clear_code)
     {

programming_language: C
CVE-2022-1886 (published 2022-05-26T15:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-05-25 15:15:38+01:00
msg: patch 8.2.5016: access before start of text with a put command

Problem:    Access before start of text with a put command.
Solution:   Check the length is more than zero.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: register.c
change_type: ModificationType.MODIFY
diff: @@ -2219,9 +2219,12 @@ error:
 	    len = STRLEN(y_array[y_size - 1]);
 	    col = (colnr_T)len - lendiff;
 	    if (col > 1)
-		curbuf->b_op_end.col = col - 1
-				- mb_head_off(y_array[y_size - 1],
+	    {
+		curbuf->b_op_end.col = col - 1;
+		if (len > 0)
+		    curbuf->b_op_end.col -= mb_head_off(y_array[y_size - 1],
 						y_array[y_size - 1] + len - 1);
+	    }
 	    else
 		curbuf->b_op_end.col = 0;
 

programming_language: C
filename: test_put.vim
change_type: ModificationType.MODIFY
diff: @@ -210,5 +210,14 @@ func Test_multibyte_op_end_mark()
   bwipe!
 endfunc
 
+" this was putting a mark before the start of a line
+func Test_put_empty_register()
+  new
+  norm yy
+  norm [Pi00ggv)s0
+  sil! norm [P
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5016,
 /**/
     5015,
 /**/

programming_language: Ruby
CVE-2022-36446 (published 2022-07-25T06:15Z)

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-116
cwe_name: Improper Encoding or Escaping of Output
description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
extended_description: 
            Improper encoding or escaping can allow attackers to change the commands that are sent to another component, inserting malicious commands instead.
            Most products follow a certain protocol that uses structured messages for communication between components, such as queries or commands. These structured messages can contain raw data interspersed with metadata or control information. For example, "GET /index.html HTTP/1.1" is a structured message containing a command ("GET") with a single argument ("/index.html") and metadata about which protocol version is being used ("HTTP/1.1").
            If an application uses attacker-supplied inputs to construct a structured message without properly encoding or escaping, then the attacker could insert special characters that will cause the data to be interpreted as control information or metadata. Consequently, the component that receives the output will perform the wrong operations, or otherwise interpret the data incorrectly.
         
         

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Jamie Cameron
author_date: 2022-07-10 16:51:57-07:00
msg: Command to show in the UI should not be escaped, but the actual command must be
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: apt-lib.pl
change_type: ModificationType.MODIFY
diff: @@ -21,10 +21,10 @@ local (@rv, @newpacks);
 
 # Build the command to run
 $ENV{'DEBIAN_FRONTEND'} = 'noninteractive';
+local $uicmd = "$apt_get_command -y ".($force ? " -f" : "")." install $update";
 $update = join(" ", map { quotemeta($_) } split(/\s+/, $update));
-$update =~ s/\\(-)|\\(.)/$1$2/g;
 local $cmd = "$apt_get_command -y ".($force ? " -f" : "")." install $update";
-print "<b>",&text('apt_install', "<tt>$cmd</tt>"),"</b><p>\n";
+print "<b>",&text('apt_install', "<tt>".&html_escape($uicmd)."</tt>"),"</b><p>\n";
 print "<pre>";
 &additional_log('exec', undef, $cmd);
 

programming_language: Perl
CVE-2021-3799 (published 2021-09-27T13:15Z)

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-1021
cwe_name: Improper Restriction of Rendered UI Layers or Frames
description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
extended_description: A web application is expected to place restrictions on whether it is allowed to be rendered within frames, iframes, objects, embed or applet elements. Without the restrictions, users can be tricked into interacting with the application when they were not intending to.
         

Fix information:
repo_url: https://github.com/getgrav/grav-plugin-admin
commit_details: repo_url: https://github.com/getgrav/grav-plugin-admin
author: Matias Griese
author_date: 2021-09-01 13:17:21+03:00
msg: Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack
repository: repo_url: https://github.com/getgrav/grav-plugin-admin
repo_name: getgrav/grav-plugin-admin
description: Grav Admin Plugin
repo_language: PHP
owner: getgrav
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,7 @@
 
 3. [](#bugfix)
     * Fixed regression `Argument 4 passed to Grav\Plugin\Form\TwigExtension::prepareFormField() must be of the type array` [#2177](https://github.com/getgrav/grav-plugin-admin/issues/2177)
+    * Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack
 
 # v1.10.19
 ## 08/31/2021

programming_language: Markdown
filename: Router.php
change_type: ModificationType.MODIFY
diff: @@ -67,6 +67,6 @@ class Router extends ProcessorBase
         $this->stopTimer();
 
         // Never allow admin pages to be rendered in <frame>, <iframe>, <embed> or <object> for improved security.
-        return $response->withHeader('X-Frame-Options', 'NONE');
+        return $response->withHeader('X-Frame-Options', 'DENY');
     }
 }

programming_language: PHP
CVE-2021-21330 (published 2021-02-26T03:15Z)

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/aio-libs/aiohttp
commit_details: repo_url: https://github.com/aio-libs/aiohttp
author: Sviatoslav Sydorenko
author_date: 2021-02-25 18:58:51+01:00
msg: Merge branch 'ghsa-v6wp-4m6f-gcjg' into master

This patch fixes an open redirect vulnerability bug in
`aiohttp.web_middlewares.normalize_path_middleware` by
making sure that there's at most one slash at the
beginning of the `Location` header value.

Refs:
* https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
* https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
repository: repo_url: https://github.com/aio-libs/aiohttp
repo_name: aio-libs/aiohttp
description: Asynchronous HTTP client/server framework for asyncio and Python
repo_language: Python
owner: aio-libs