starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-12256 (published 2018-08-16T20:29Z)

admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/litecart/litecart
commit_details: repo_url: https://github.com/litecart/litecart
author: timint
author_date: 2018-06-15 00:54:20+02:00
msg: ! Verify that uploads have valid xml and vqmod content
repository: repo_url: https://github.com/litecart/litecart
repo_name: litecart/litecart
description: LiteCart is a superfast e-commerce platform. Free for everyone to use. Built with the obsession of lightweight using PHP, jQuery HTML 5 and CSS 3.
repo_language: PHP
owner: litecart
file_changes: filename: vqmods.inc.php
change_type: ModificationType.MODIFY
diff: @@ -49,11 +49,25 @@
         throw new Exception(language::translate('error_must_select_file_to_upload', 'You must select a file to upload'));
       }
 
-      if (!in_array($_FILES['vqmod']['type'], array('text/xml', 'application/xml'))) {
-        throw new Exception(language::translate('error_must_provide_vqmod', 'You must provide a valid vQmod file'));
+      $dom = new DOMDocument('1.0', 'UTF-8');
+
+      $xml = file_get_contents($_FILES['vqmod']['tmp_name']); // DOMDocument::load() does not support Windows paths so we use DOMDocument::loadXML()
+
+      if (!@$dom->loadXML($xml)) {
+        throw new Exception(language::translate('error_invalid_xml_file', 'Invalid XML file'));
+      }
+
+      if (!$dom->getElementsByTagName('modification')) {
+        throw new Exception(language::translate('error_xml_file_is_not_valid_vqmod', 'XML file is not a valid vQmod file'));
       }
 
-      move_uploaded_file($_FILES['vqmod']['tmp_name'], FS_DIR_HTTP_ROOT . WS_DIR_HTTP_HOME .'vqmod/xml/'. $_FILES['vqmod']['name']);
+      $filename = FS_DIR_HTTP_ROOT . WS_DIR_HTTP_HOME .'vqmod/xml/'. pathinfo($_FILES['vqmod']['name'], PATHINFO_FILENAME) .'.xml';
+
+      if (is_file($filename)) {
+        unlink($filename);
+      }
+
+      move_uploaded_file($_FILES['vqmod']['tmp_name'], $filename);
 
       notices::add('success', language::translate('success_changes_saved', 'Changes saved successfully'));
       header('Location: '. document::ilink());
@@ -63,6 +77,7 @@
       notices::add('errors', $e->getMessage());
     }
   }
+
 ?>
 <h1><?php echo $app_icon; ?> <?php echo language::translate('title_vqmods', 'vQmods'); ?></h1>
 

programming_language: PHP
CVE-2022-3324 (published 2022-09-27T23:15Z)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-121
cwe_name: Stack-based Buffer Overflow
description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-09-26 23:08:22+01:00
msg: patch 9.0.0598: using negative array index with negative width window

Problem:    Using negative array index with negative width window.
Solution:   Make sure the window width does not become negative.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_cmdwin.vim
change_type: ModificationType.MODIFY
diff: @@ -404,5 +404,27 @@ func Test_cmdwin_freed_buffer_ptr()
   bwipe!
 endfunc
 
+" This was resulting in a window with negative width.
+" The test doesn't reproduce the illegal memory access though...
+func Test_cmdwin_split_often()
+  let lines = &lines
+  let columns = &columns
+  set t_WS=
+
+  try
+    set encoding=iso8859
+    set ruler
+    winsize 0 0
+    noremap 0 H
+    sil norm 0000000q:
+  catch /E36:/
+  endtry
+
+  bwipe!
+  set encoding=utf8
+  let &lines = lines
+  let &columns = columns
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    598,
 /**/
     597,
 /**/

programming_language: Ruby
filename: window.c
change_type: ModificationType.MODIFY
diff: @@ -2089,6 +2089,8 @@ win_equal_rec(
 		if (hnc)	    // add next_curwin size
 		{
 		    next_curwin_size -= p_wiw - (m - n);
+		    if (next_curwin_size < 0)
+			next_curwin_size = 0;
 		    new_size += next_curwin_size;
 		    room -= new_size - next_curwin_size;
 		}
@@ -6611,7 +6613,8 @@ scroll_to_fraction(win_T *wp, int prev_height)
     void
 win_new_width(win_T *wp, int width)
 {
-    wp->w_width = width;
+    // Should we give an error if width < 0?
+    wp->w_width = width < 0 ? 0 : width;
     wp->w_lines_valid = 0;
     changed_line_abv_curs_win(wp);
     // Handled in win_fix_scroll()

programming_language: C
CVE-2021-23394 (published 2021-06-13T11:15Z)

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/Studio-42/elFinder
commit_details: repo_url: https://github.com/Studio-42/elFinder
author: nao-pon
author_date: 2021-05-31 20:50:39+09:00
msg: [VD:abstract] add `'phar:*' => 'text/x-php'` into 'staticMineMap'

rel. #3295
repository: repo_url: https://github.com/Studio-42/elFinder
repo_name: Studio-42/elFinder
description: 📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
repo_language: JavaScript
owner: Studio-42
file_changes: filename: elFinderVolumeDriver.class.php
change_type: ModificationType.MODIFY
diff: @@ -281,6 +281,7 @@ abstract class elFinderVolumeDriver
             'php5:*' => 'text/x-php',
             'php7:*' => 'text/x-php',
             'phtml:*' => 'text/x-php',
+            'phar:*' => 'text/x-php',
             'cgi:*' => 'text/x-httpd-cgi',
             'pl:*' => 'text/x-perl',
             'asp:*' => 'text/x-asap',

programming_language: PHP
CVE-2022-25258 (published 2022-02-16T20:15Z)

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Szymon Heidrich
author_date: 2022-01-24 12:14:00+01:00
msg: USB: gadget: validate interface OS descriptor requests

Stall the control endpoint in case provided index exceeds array size of
MAX_CONFIG_INTERFACES or when the retrieved function pointer is null.

Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: composite.c
change_type: ModificationType.MODIFY
diff: @@ -1988,6 +1988,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 				if (w_index != 0x5 || (w_value >> 8))
 					break;
 				interface = w_value & 0xFF;
+				if (interface >= MAX_CONFIG_INTERFACES ||
+				    !os_desc_cfg->interface[interface])
+					break;
 				buf[6] = w_index;
 				count = count_ext_prop(os_desc_cfg,
 					interface);

programming_language: C
CVE-2024-29192 (published 2024-04-04T18:15Z)

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an attacker may be able to achieve that depending on how go2rtc is set up on the upstream application, and given that this endpoint is not protected against CSRF, it allows requests from any origin (e.g. a "drive-by" attack) . The `exec` handler allows for any stream to execute arbitrary commands. An attacker may add a custom stream through `api/config`, which may lead to arbitrary command execution. In the event of a victim visiting the server in question, their browser will execute the requests against the go2rtc instance. Commit 8793c3636493c5efdda08f3b5ed5c6e1ea594fd9 adds a warning about secure API access.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/AlexxIT/go2rtc
commit_details: repo_url: https://github.com/AlexxIT/go2rtc
author: Alex X
author_date: 2024-01-11 14:26:51+03:00
msg: Add warning about secure access for API to docs
repository: repo_url: https://github.com/AlexxIT/go2rtc
repo_name: AlexxIT/go2rtc
description: Ultimate camera streaming application with support RTSP, RTMP, HTTP-FLV, WebRTC, MSE, HLS, MP4, MJPEG, HomeKit, FFmpeg, etc.
repo_language: Go
owner: AlexxIT
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -790,6 +790,8 @@ streams:
 
 The HTTP API is the main part for interacting with the application. Default address: `http://localhost:1984/`.
 
+**Important!** go2rtc passes requests from localhost and from unix socket without HTTP authorisation, even if you have it configured! It is your responsibility to set up secure external access to API. If not properly configured, an attacker can gain access to your cameras and even your server.
+
 [API description](https://github.com/AlexxIT/go2rtc/tree/master/api).
 
 **Module config**

programming_language: Markdown
CVE-2018-11381 (published 2018-05-22T19:29Z)

The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-04-18 13:36:45+02:00
msg: Fix #9902 - Fix oobread in RBin.string_scan_range
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: file.c
change_type: ModificationType.MODIFY
diff: @@ -76,11 +76,12 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		eprintf ("Invalid range to find strings 0x%llx .. 0x%llx\n", from, to);
 		return -1;
 	}
-	ut8 *buf = calloc (to - from, 1);
+	int len = to - from;
+	ut8 *buf = calloc (len, 1);
 	if (!buf || !min) {
 		return -1;
 	}
-	r_buf_read_at (bf->buf, from, buf, to - from);
+	r_buf_read_at (bf->buf, from, buf, len);
 	// may oobread
 	while (needle < to) {
 		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
@@ -90,8 +91,8 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		}
 		if (type == R_STRING_TYPE_DETECT) {
 			char *w = (char *)buf + needle + rc - from;
-			if ((to - needle) > 5) {
-				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4];
+			if ((to - needle) > 5 + rc) {
+				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
 				if (is_wide32) {
 					str_type = R_STRING_TYPE_WIDE32;
 				} else {

programming_language: C
CVE-2015-4619 (published 2017-09-07T20:29Z)

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/denkGroot/Spina
commit_details: repo_url: https://github.com/denkGroot/Spina
author: Bram Jetten
author_date: 2015-06-16 16:23:27+02:00
msg: protect from forgery
repository: repo_url: https://github.com/denkGroot/Spina
repo_name: denkGroot/Spina
description: Spina CMS
repo_language: HTML
owner: denkGroot
file_changes: filename: application_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
 module Spina
   class ApplicationController < ActionController::Base
+    protect_from_forgery
+    
     include ApplicationHelper
 
     private

programming_language: Ruby
CVE-2024-39918 (published 2024-07-15T20:15Z)

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jasonraimondi/url-to-png
commit_details: repo_url: https://github.com/jasonraimondi/url-to-png
author: Nishant Jain
author_date: 2024-07-11 19:11:25-07:00
msg: sanitize params
repository: repo_url: https://github.com/jasonraimondi/url-to-png
repo_name: jasonraimondi/url-to-png
description: Selfhosted. URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB
repo_language: TypeScript
owner: jasonraimondi
file_changes: filename: extract_query_params.ts
change_type: ModificationType.MODIFY
diff: @@ -72,7 +72,7 @@ export function handleExtractQueryParamsMiddleware(encryptionService?: StringEnc
 
     const date = new Date();
     const dateString = date.toLocaleDateString().replace(/\//g, "-");
-    const imageId = dateString + "." + slugify(validData.url) + configToString(params);
+    const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));
 
     c.set("input", validData);
     c.set("imageId", imageId);

programming_language: TypeScript
CVE-2019-17545 (published 2019-10-14T02:15Z)

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/OSGeo/gdal
commit_details: repo_url: https://github.com/OSGeo/gdal
author: Even Rouault
author_date: 2019-08-04 21:00:33+02:00
msg: OGRExpatRealloc(): fix double-free when size to allocate is above the default 10MB threshold. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178. Credit to OSS Fuzz
repository: repo_url: https://github.com/OSGeo/gdal
repo_name: OSGeo/gdal
description: GDAL is an open source MIT licensed translator library for raster and vector geospatial data formats.
repo_language: C++
owner: OSGeo
file_changes: filename: ogr_expat.cpp
change_type: ModificationType.MODIFY
diff: @@ -89,7 +89,6 @@ static void* OGRExpatRealloc( void *ptr, size_t size )
     if( CanAlloc(size) )
         return realloc(ptr, size);
 
-    free(ptr);
     return nullptr;
 }
 

programming_language: C++
CVE-2021-3829 (published 2021-12-10T16:15Z)

openwhyd is vulnerable to URL Redirection to Untrusted Site

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/openwhyd/openwhyd
commit_details: repo_url: https://github.com/openwhyd/openwhyd
author: Adrien Joly
author_date: 2021-12-10 11:03:41+01:00
msg: fix(security): Prevent redirect to a disguised domain (#498)

Improves #496, as suggested on this report: https://huntr.dev/bounties/6b8acb0c-8b5d-461e-9b46-b1bfb5a8ccdf/
repository: repo_url: https://github.com/openwhyd/openwhyd
repo_name: openwhyd/openwhyd
description: 💎 Like Pinterest, but for Music 🎧
repo_language: JavaScript
owner: openwhyd
file_changes: filename: logging.js
change_type: ModificationType.MODIFY
diff: @@ -262,7 +262,8 @@ http.ServerResponse.prototype.redirect = function (url) {
 
 http.ServerResponse.prototype.safeRedirect = function (url) {
   const fullURL = new URL(url, config.urlPrefix);
-  if (!fullURL.toString().startsWith(config.urlPrefix)) return this.forbidden();
+  if (`${fullURL.protocol}//${fullURL.host}` !== config.urlPrefix)
+    return this.forbidden();
   this.redirect(url);
 };
 

programming_language: JavaScript
filename: security.api.tests.js
change_type: ModificationType.MODIFY
diff: @@ -43,5 +43,14 @@ describe('security', () => {
       });
       assert.equal(response.statusCode, 403); // forbidden
     });
+
+    it('should NOT allow redirect to a disguised domain', async () => {
+      const { jar } = await loginAs(ADMIN_USER);
+      const { response } = await postRaw(jar, `/consent`, {
+        lang: 'en',
+        redirect: `${URL_PREFIX}@google.com`,
+      });
+      assert.equal(response.statusCode, 403); // forbidden
+    });
   });
 });

programming_language: TypeScript