starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-0762 (published 2022-02-26T10:15Z)

Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.\n\n

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-02-25 11:43:45+02:00
msg: check product is deleted before add to cart
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: CartManager.php
change_type: ModificationType.MODIFY
diff: @@ -565,7 +565,21 @@ class CartManager extends Crud
         }
 
         if ($data['for'] == 'content') {
+
             $cont = $this->app->content_manager->get_by_id($for_id);
+
+            if (isset($cont['is_active'])) {
+                if ($cont['is_active'] != 1) {
+                    $cont = false;
+                }
+            }
+
+            if (isset($cont['is_deleted'])) {
+                if ($cont['is_deleted'] > 0) {
+                    $cont = false;
+                }
+            }
+
             $cont_data = $this->app->content_manager->data($for_id);
             if ($cont == false) {
                 return array('error' => 'Invalid product?');

programming_language: PHP
CVE-2022-1898 (published 2022-05-27T09:15Z)

Use After Free in GitHub repository vim/vim prior to 8.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-05-26 16:32:44+01:00
msg: patch 8.2.5024: using freed memory with "]d"

Problem:    Using freed memory with "]d".
Solution:   Copy the pattern before searching.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: normal.c
change_type: ModificationType.MODIFY
diff: @@ -4464,6 +4464,11 @@ nv_brackets(cmdarg_T *cap)
 	    clearop(cap->oap);
 	else
 	{
+	    // Make a copy, if the line was changed it will be freed.
+	    ptr = vim_strnsave(ptr, len);
+	    if (ptr == NULL)
+		return;
+
 	    find_pattern_in_path(ptr, 0, len, TRUE,
 		cap->count0 == 0 ? !isupper(cap->nchar) : FALSE,
 		((cap->nchar & 0xf) == ('d' & 0xf)) ?  FIND_DEFINE : FIND_ANY,
@@ -4472,6 +4477,7 @@ nv_brackets(cmdarg_T *cap)
 			    islower(cap->nchar) ? ACTION_SHOW : ACTION_GOTO,
 		cap->cmdchar == ']' ? curwin->w_cursor.lnum + 1 : (linenr_T)1,
 		(linenr_T)MAXLNUM);
+	    vim_free(ptr);
 	    curwin->w_set_curswant = TRUE;
 	}
     }

programming_language: C
filename: test_tagjump.vim
change_type: ModificationType.MODIFY
diff: @@ -1399,6 +1399,12 @@ func Test_define_search()
   sil norm o0
   sil! norm 
   bwipe!
+
+  new somefile
+  call setline(1, ['first line', '', '#define something 0'])
+  sil norm 0o0
+  sil! norm ]d
+  bwipe!
 endfunc
 
 " Test for [*, [/, ]* and ]/

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5024,
 /**/
     5023,
 /**/

programming_language: Ruby
CVE-2023-25567 (published 2023-02-14T18:15Z)

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gssapi/gss-ntlmssp
commit_details: repo_url: https://github.com/gssapi/gss-ntlmssp
author: Simo Sorce
author_date: 2023-02-07 11:53:11-05:00
msg: GHSL-2023-011: Out-of-bounds read when decoding

Out-of-bounds read when decoding target information (GHSL-2023-011)

Fixes defect GHSL-2023-011 found by the GitHub Security Lab team via
oss-fuzz.

The lenght of the av_pair is not checked properly for two of the
elements. In case the lenght is shorter than requires this may cause an
out-of-bound read that either reads garbage or may cause a crash by
reading unmapped memory.

This can be exploited to crash the service causing a DoS.

Signed-off-by: Simo Sorce <simo@redhat.com>
repository: repo_url: https://github.com/gssapi/gss-ntlmssp
repo_name: gssapi/gss-ntlmssp
description: A complete implementation of the MS-NLMP documents as a GSSAPI mechanism
repo_language: C
owner: gssapi
file_changes: filename: ntlm.c
change_type: ModificationType.MODIFY
diff: @@ -685,11 +685,19 @@ int ntlm_decode_target_info(struct ntlm_ctx *ctx, struct ntlm_buffer *buffer,
             break;
         case MSV_AV_TIMESTAMP:
             if (!av_timestamp) continue;
+            if (av_len < sizeof(timestamp)) {
+                ret = ERR_DECODE;
+                goto done;
+            }
             memcpy(&timestamp, av_pair->value, sizeof(timestamp));
             timestamp = le64toh(timestamp);
             break;
         case MSV_AV_FLAGS:
             if (!av_flags) continue;
+            if (av_len < sizeof(flags)) {
+                ret = ERR_DECODE;
+                goto done;
+            }
             memcpy(&flags, av_pair->value, sizeof(flags));
             flags = le32toh(flags);
             break;

programming_language: C
CVE-2022-1115 (published 2022-08-29T15:15Z)

A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2022-03-22 20:11:47-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/4974
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1987,7 +1987,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
-        extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else

programming_language: C
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2022-03-22 20:11:27-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/4974
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1894,7 +1894,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
-        extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else

programming_language: C
CVE-2023-52079 (published 2023-12-28T16:16Z)

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.  \nExploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/kriszyp/msgpackr
commit_details: repo_url: https://github.com/kriszyp/msgpackr
author: Kris Zyp
author_date: 2023-12-25 19:59:59-07:00
msg: Ensure that string conversion doesn't recursively join or execute code
repository: repo_url: https://github.com/kriszyp/msgpackr
repo_name: kriszyp/msgpackr
description: Ultra-fast MessagePack implementation with extension for record and structural cloning / msgpack.org[JavaScript/NodeJS]
repo_language: JavaScript
owner: kriszyp
file_changes: filename: unpack.js
change_type: ModificationType.MODIFY
diff: @@ -914,7 +914,7 @@ function readKey() {
 			return readFixedString(length)
 	} else { // not cacheable, go back and do a standard read
 		position--
-		return read().toString()
+		return asSafeString(read())
 	}
 	let key = ((length << 5) ^ (length > 1 ? dataView.getUint16(position) : length > 0 ? src[position] : 0)) & 0xfff
 	let entry = keyCache[key]
@@ -966,9 +966,15 @@ function readKey() {
 	return entry.string = readFixedString(length)
 }
 
+function asSafeString(property) {
+	if (typeof property === 'string') return property;
+	if (typeof property === 'number') return property.toString();
+	throw new Error('Invalid property type for record', typeof property);
+}
 // the registration of the record definition extension (as "r")
 const recordDefinition = (id, highByte) => {
-	let structure = read().map(property => property.toString()) // ensure that all keys are strings and that the array is mutable
+	let structure = read().map(asSafeString) // ensure that all keys are strings and
+	// that the array is mutable
 	let firstByte = id
 	if (highByte !== undefined) {
 		id = id < 32 ? -((highByte << 5) + id) : ((highByte << 5) + id)

programming_language: Go
CVE-2007-10002 (published 2023-01-08T10:15Z)

A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/login_password/LANG leads to sql injection. The attack may be launched remotely. The name of the patch is 2bcbead3bdb5f118bf2c38c541eaa73c29dcc90f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217640.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/web-cyradm/web-cyradm
commit_details: repo_url: https://github.com/web-cyradm/web-cyradm
author: luc
author_date: 2007-07-01 08:09:39+00:00
msg: Prevention of SQL injection
repository: repo_url: https://github.com/web-cyradm/web-cyradm
repo_name: web-cyradm/web-cyradm
description: Web-cyradm is a web based software that glues topnotch mailing technologies like cyrus-imap and postfix together.
repo_language: PHP
owner: web-cyradm
file_changes: filename: auth.inc.php
change_type: ModificationType.MODIFY
diff: @@ -10,9 +10,9 @@ session_start();
 
 $session_ok = $_SESSION['session_ok'];
 
-$login = $_POST['login'];
-$password = $_POST['login_password'];
-$LANG = $_POST['LANG'];
+$login = addslashes($_POST['login']);
+$password = addslashes($_POST['login_password']);
+$LANG = addslashes($_POST['LANG']);
 
 if ($login && $password){
      // Log access

programming_language: PHP
CVE-2021-31245 (published 2021-05-06T13:15Z)

omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/Ysurac/openmptcprouter-vps-admin
commit_details: repo_url: https://github.com/Ysurac/openmptcprouter-vps-admin
author: Ycarus (Yannick Chabanois)
author_date: 2021-04-08 17:37:19+02:00
msg: Fix timing attacks potential vulnerability
repository: repo_url: https://github.com/Ysurac/openmptcprouter-vps-admin
repo_name: Ysurac/openmptcprouter-vps-admin
description: OpenMPTCProuter VPS admin rest api
repo_language: Python
owner: Ysurac
file_changes: filename: omr-admin.py
change_type: ModificationType.MODIFY
diff: @@ -776,7 +776,7 @@ with open('/etc/openmptcprouter-vps-admin/omr-admin-config.json') as f:
 fake_users_db = omr_config_data['users'][0]
 
 def verify_password(plain_password, user_password):
-    if plain_password == user_password:
+    if secrets.compare_digest(plain_password,user_password):
         LOG.debug("password true")
         return True
     return False

programming_language: Python
CVE-2021-23206 (published 2022-03-02T23:15Z)

A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of service.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-04-01 08:21:57-04:00
msg: Fix crash bugs with bogus table attributes (Issue #416)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
-- Fixed a crach bug with bogus table attributes (Issue #417)
+- Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed some issues reported by Coverity.

programming_language: Markdown
filename: ps-pdf.cxx
change_type: ModificationType.MODIFY
diff: @@ -5735,7 +5735,7 @@ render_table_row(hdtable_t &table,
       if ((var = htmlGetVariable(cells[row][col], (uchar *)"ROWSPAN")) != NULL)
         table.row_spans[col] = atoi((char *)var);
 
-      if (table.row_spans[col] == 1)
+      if (table.row_spans[col] <= 1)
         table.row_spans[col] = 0;
 
       if (table.row_spans[col] > (table.num_rows - row))
@@ -6570,7 +6570,12 @@ parse_table(tree_t *t,			// I - Tree to parse
         {
 	  // Handle colspan and rowspan stuff...
           if ((var = htmlGetVariable(tempcol, (uchar *)"COLSPAN")) != NULL)
-            colspan = atoi((char *)var);
+          {
+            if ((colspan = atoi((char *)var)) < 1)
+              colspan = 1;
+            else if (colspan > (MAX_COLUMNS - col))
+              colspan = MAX_COLUMNS - col;
+          }
           else
             colspan = 1;
 
@@ -6578,7 +6583,7 @@ parse_table(tree_t *t,			// I - Tree to parse
 	  {
             table.row_spans[col] = atoi((char *)var);
 
-	    if (table.row_spans[col] == 1)
+	    if (table.row_spans[col] <= 1)
 	      table.row_spans[col] = 0;
 
 	    for (tcol = 1; tcol < colspan; tcol ++)
@@ -6600,6 +6605,11 @@ parse_table(tree_t *t,			// I - Tree to parse
 	    {
               col_width -= 2.0 * table.cellpadding;
 	    }
+
+	    if (col_width <= 0.0f)
+	      col_width = 0.0f;
+	    else if (col_width > PageWidth)
+	      col_width = PageWidth;
 	  }
 	  else
 	    col_width = 0.0f;

programming_language: C
CVE-2022-0824 (published 2022-03-02T12:15Z)

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Ilia Rostovtsev
author_date: 2022-02-20 12:48:27+03:00
msg: Foreign module may need a check
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: web-lib-funcs.pl
change_type: ModificationType.MODIFY
diff: @@ -5144,7 +5144,8 @@ if ($module_name) {
 	}
 
 if ($module_name && !$main::no_acl_check &&
-    !defined($ENV{'FOREIGN_MODULE_NAME'}) &&
+    (!defined($ENV{'FOREIGN_MODULE_NAME'}) ||
+      defined($ENV{'FOREIGN_MODULE_SEC_CHECK'})) &&
     $main::webmin_script_type eq 'web') {
 	# Check if the HTTP user can access this module
 	if (!&foreign_available($module_name)) {

programming_language: Perl