starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-36082 (published 2022-09-07T22:15Z)

mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mansuf/mangadex-downloader
commit_details: repo_url: https://github.com/mansuf/mangadex-downloader
author: Rahman Yusuf
author_date: 2022-09-04 22:25:37+07:00
msg: Fix improper validation in `file:<location>` syntax
repository: repo_url: https://github.com/mansuf/mangadex-downloader
repo_name: mansuf/mangadex-downloader
description: A command-line tool to download manga from MangaDex, written in Python.
repo_language: Python
owner: mansuf
file_changes: filename: validator.py
change_type: ModificationType.MODIFY
diff: @@ -31,15 +31,16 @@ def _validate(url):
         raise argparse.ArgumentTypeError(str(e))
     return _url
 
-def validate_url(url):
-    if os.path.exists(url):
-        with open(url, 'r') as opener:
-            content = opener.read()
-    else:
-        content = url
+def _try_read(path):
+    if not os.path.exists(path):
+        return None
+    
+    with open(path, 'r') as o:
+        return o.read()
 
+def validate_url(url):
     urls = []
-    for _url in content.splitlines():
+    for _url in url.splitlines():
         if not _url:
             continue
 
@@ -245,7 +246,8 @@ def validate(parser, args):
             elif not os.path.exists(file_path):
                 parser.error(f"File \"{file_path}\" is not exist")
         else:
-            file_path = urls
+            file_content = _try_read(urls)
+            file_path = file_content if file_content is not None else urls
         try:
             args.URL = validate_url(file_path)
         except argparse.ArgumentTypeError as e:

programming_language: Python
CVE-2021-41279 (published 2021-11-26T18:15Z)

BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: gondoh
author_date: 2021-11-25 15:19:42+09:00
msg: Merge pull request from GHSA-4x2f-54wr-4hjg

* 固定ページプレビュー実行時に入力内容検証を追加

* SimpleZipの利用を停止しZipArchiveの利用に切り替え

* 不要コード除去

* BcZip利用時、ZipArchiveをopenしていない場合エラーログが出力される問題を改善
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
CVE-2020-15163 (published 2020-09-09T18:15Z)

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/theupdateframework/tuf
commit_details: repo_url: https://github.com/theupdateframework/tuf
author: Lukas Puehringer
author_date: 2019-10-07 11:54:59+02:00
msg: Merge pull request #885 from trishankatdatadog:trishankatdatadog/correctly-rotate-root

Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
repository: repo_url: https://github.com/theupdateframework/tuf
repo_name: theupdateframework/python-tuf
description: Python reference implementation of The Update Framework (TUF)
repo_language: Python
owner: theupdateframework
CVE-2017-5936 (published 2017-04-12T22:59Z)

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openstack/nova-lxd
commit_details: repo_url: https://github.com/openstack/nova-lxd
author: James Page
author_date: 2017-01-31 11:23:06+00:00
msg: Ensure LXD veth host device is named correctly

LXD uses a veth pair to plumb the LXD instance into the bridge
providing access to neutron networking.

In later nova-lxd versions, the host_name parameter is set based
on the neutron configured name for the host part of the pair,
ensuring that neutron iptables firewall rules are correctly
applied to instances.

Update the mitaka version of the driver to populate the LXD
network device configuration to ensure that any firewall
rules are correctly applied.

(also dropped version from setup.cfg, as pbr will automatically
generate the version based on git tags, so its really surplus
to requirements).

Change-Id: Ic5b9ad6944a1ac45cd1983d038431252ff738985
Closes-Bug: 1656847
repository: repo_url: https://github.com/openstack/nova-lxd
repo_name: openstack-archive/nova-lxd
description: MOVED: now at https://opendev.org/x/nova-lxd
owner: openstack
file_changes: filename: config.py
change_type: ModificationType.MODIFY
diff: @@ -224,11 +224,15 @@ class LXDContainerConfig(object):
 
             for vifaddr in network_info:
                 cfg = self.vif_driver.get_config(instance, vifaddr)
-                network_devices[str(cfg['bridge'])] = \
+                key = str(cfg['bridge'])
+                network_devices[key] = \
                     {'nictype': 'bridged',
                      'hwaddr': str(cfg['mac_address']),
-                     'parent': str(cfg['bridge']),
+                     'parent': key,
                      'type': 'nic'}
+                host_device = self.vif_driver.get_vif_devname(vifaddr)
+                if host_device:
+                    network_devices[key]['host_name'] = host_device
                 return network_devices
         except Exception as ex:
             with excutils.save_and_reraise_exception():

programming_language: Python
filename: setup.cfg
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,6 @@ name = nova-lxd
 summary = native lxd driver for openstack
 description-file =
     README.md
-version = 13.2.0
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
 home-page = http://www.openstack.org/

programming_language: Haskell
CVE-2017-20173 (published 2023-01-18T16:15Z)

A vulnerability was found in AlexRed contentmap. It has been rated as critical. Affected by this issue is the function Load of the file contentmap.php. The manipulation of the argument contentid leads to sql injection. The name of the patch is dd265d23ff4abac97422835002c6a47f45ae2a66. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218492.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/AlexRed/contentmap
commit_details: repo_url: https://github.com/AlexRed/contentmap
author: AlexRed
author_date: 2017-03-08 08:35:38+00:00
msg: Corretta vulnerabilità SQL Injection
repository: repo_url: https://github.com/AlexRed/contentmap
repo_name: AlexRed/contentmap
description: Automatically exported from code.google.com/p/contentmap
repo_language: PHP
owner: AlexRed
file_changes: filename: articlesmarkers.php
change_type: ModificationType.MODIFY
diff: @@ -355,7 +355,7 @@ class articleGoogleMapMarkers extends GoogleMapMarkers
 		$query->from("#__content");
 
 		// Condition: content id passed py plugin
-		$query->where("id = '" . JRequest::getVar("contentid", 0, "GET") . "'");
+		$query->where("id = '" . intval(JRequest::getVar("contentid", 0, "GET")) . "'");
 
 		// Condition: metadata field contains "xreference":"coordinates"
 		// {\"xreference\":\"} the string "xreference":"

programming_language: PHP
filename: view.html.php
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,10 @@ class ContentMapViewSmartLoader extends JViewLegacy
 		// Load module || component || plugin parameters. Defaults to plugin
 		$owner = JRequest::getVar("owner", "", "GET") or $owner = "plugin"; // getVar() default value doesn't work with ?owner=""
 
+		if (!in_array($owner,array('module','plugin','component','article'))){
+			die();
+		}
+		
 		$db = JFactory::getDbo();
 		jimport("joomla.database.databasequery");
 		$query = $db->getQuery(true);

programming_language: PHP
CVE-2019-19075 (published 2019-11-18T06:15Z)

A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-17 17:47:12-05:00
msg: ieee802154: ca8210: prevent memory leak

In ca8210_probe the allocated pdata needs to be assigned to
spi_device->dev.platform_data before calling ca8210_get_platform_data.
Othrwise when ca8210_get_platform_data fails pdata cannot be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190917224713.26371-1-navid.emamdoost@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ca8210.c
change_type: ModificationType.MODIFY
diff: @@ -3152,12 +3152,12 @@ static int ca8210_probe(struct spi_device *spi_device)
 		goto error;
 	}
 
+	priv->spi->dev.platform_data = pdata;
 	ret = ca8210_get_platform_data(priv->spi, pdata);
 	if (ret) {
 		dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n");
 		goto error;
 	}
-	priv->spi->dev.platform_data = pdata;
 
 	ret = ca8210_dev_com_init(priv);
 	if (ret) {

programming_language: C
CVE-2012-2745 (published 2012-08-09T10:29Z)

The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

Severity: MEDIUM
CVSS v2 base score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Oleg Nesterov
author_date: 2012-04-09 21:03:50+02:00
msg: cred: copy_process() should clear child->replacement_session_keyring

keyctl_session_to_parent(task) sets ->replacement_session_keyring,
it should be processed and cleared by key_replace_session_keyring().

However, this task can fork before it notices TIF_NOTIFY_RESUME and
the new child gets the bogus ->replacement_session_keyring copied by
dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).

change copy_creds() to clear this member. If copy_process() fails
before this point the wrong ->replacement_session_keyring doesn't
matter, exit_creds() won't be called.

Cc: <stable@vger.kernel.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: cred.c
change_type: ModificationType.MODIFY
diff: @@ -386,6 +386,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
 	struct cred *new;
 	int ret;
 
+	p->replacement_session_keyring = NULL;
+
 	if (
 #ifdef CONFIG_KEYS
 		!p->cred->thread_keyring &&

programming_language: C
CVE-2021-25924 (published 2021-04-01T18:15Z)

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.

Severity: HIGH
CVSS v2 base score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/gocd/gocd
commit_details: repo_url: https://github.com/gocd/gocd
author: Aravind SV
author_date: 2021-02-19 10:46:02+00:00
msg: #000 - Add missing Content-Type check
repository: repo_url: https://github.com/gocd/gocd
repo_name: gocd/gocd
description: GoCD - Continuous Delivery server main repository
repo_language: Java
owner: gocd
file_changes: filename: BackupConfigControllerV1.java
change_type: ModificationType.MODIFY
diff: @@ -65,7 +65,9 @@ public class BackupConfigControllerV1 extends ApiController implements SparkSpri
     public void setupRoutes() {
         path(controllerBasePath(), () -> {
             before("", mimeType, this::setContentType);
-
+            before("/*", mimeType, this::setContentType);
+            before("", mimeType, this::verifyContentType);
+            before("/*", mimeType, this::verifyContentType);
 
             // change the line below to enable appropriate security
             before("", mimeType, this.apiAuthenticationHelper::checkAdminUserAnd403);

programming_language: Java
CVE-2020-26244 (published 2020-12-02T20:15Z)

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/OpenIDC/pyoidc
commit_details: repo_url: https://github.com/OpenIDC/pyoidc
author: tpazderka
author_date: 2020-12-01 11:22:03+01:00
msg: Merge pull request from GHSA-4fjv-pmhg-3rfg

Cve 2020 26244
repository: repo_url: https://github.com/OpenIDC/pyoidc
repo_name: CZ-NIC/pyoidc
description: A complete OpenID Connect implementation in Python
repo_language: Python
owner: OpenIDC
CVE-2022-23613 (published 2022-02-07T22:15Z)

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://github.com/neutrinolabs/xrdp
commit_details: repo_url: https://github.com/neutrinolabs/xrdp
author: metalefty
author_date: 2022-02-07 15:18:15+09:00
msg: Merge pull request from GHSA-8h98-h426-xf32

Add lower bound to sesman data input size check
repository: repo_url: https://github.com/neutrinolabs/xrdp
repo_name: neutrinolabs/xrdp
description: xrdp: an open source RDP server
repo_language: C
owner: neutrinolabs