starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-15030 (published 2023-03-25T18:15Z)

A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223803.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/Arno0x/TwoFactorAuth
commit_details: repo_url: https://github.com/Arno0x/TwoFactorAuth
author: vaultwiki
author_date: 2016-01-27 17:15:48-05:00
msg: cross-site ?from can be used for phishing

Using cross-site ?from, the user can be presented with a fake "auth failed" page, which will trick them into logging in again. Since they are now on a different site, the site can capture their user, password, and current token in order to steal their access to the real site.
repository: repo_url: https://github.com/Arno0x/TwoFactorAuth
repo_name: Arno0x/TwoFactorAuth
description: Two Factor Authentication web portal written in PHP
repo_language: PHP
owner: Arno0x
file_changes: filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -84,8 +84,12 @@ else {
 	        
 	        //--------------------------------------------------
 	        // Checking which URL we should redirect the user to
-	        if (isset($_POST["from"])) {
-	        	$from = urldecode($_POST["from"]);
+	        if (isset($_GET['from'])) {
+	        	$from = $_GET['from'];
+			if (preg_match('#^(?:https?:)?//#', $_GET['from'], $m)) {
+				$url = parse_url($_GET['from']);
+				$from = $url['path'] . (!empty($url['query']) ? '?' . $url['query'] : '') . (!empty($url['fragment']) ? '#' . $url['fragment'] : '');
+			}
 	            $redirectTo = ((isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on")? "https://" : "http://").$_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$from;
 	        }
 	        else {

programming_language: PHP
CVE-2022-45129 (published 2022-11-10T06:15Z)

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-552
cwe_name: Files or Directories Accessible to External Parties
description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
extended_description: 
	   Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users.  Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any.  Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
	   In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
	 
         

Fix information:
repo_url: https://github.com/payara/Payara
commit_details: repo_url: https://github.com/payara/Payara
author: Andrew Pielage
author_date: 2022-10-24 16:26:02+01:00
msg: Merge pull request #5989 from luiseufrasio/FISH-6603

Fish-6603 New 0-day vulnerability exploit using ROOT context root deployments
repository: repo_url: https://github.com/payara/Payara
repo_name: payara/Payara
description: Payara Server is an open source middleware platform that supports reliable and secure deployments of Java EE (Jakarta EE) and MicroProfile applications in any environment: on premise, in the cloud or hybrid. 
repo_language: Java
owner: payara
CVE-2014-125077 (published 2023-01-15T09:15Z)

A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pointhi/searx_stats
commit_details: repo_url: https://github.com/pointhi/searx_stats
author: Thomas Pointhuber
author_date: 2014-12-19 11:53:34+01:00
msg: [enh] add SQL-Injection protection
repository: repo_url: https://github.com/pointhi/searx_stats
repo_name: pointhi/searx_stats
description: A little website which is showing current stats about searx instances
repo_language: PHP
owner: pointhi
file_changes: filename: cron.php
change_type: ModificationType.MODIFY
diff: @@ -94,10 +94,10 @@ if((bool)$config["instances"]["cronjob"] == True) {
         
         // save in database
         $query = "UPDATE `#instances` SET ".
-            "`VERSION_STRING` = '".$res_searx_version."', ".
-            "`RETURN_CODE` = '".$res_http_code."', ".
+            "`VERSION_STRING` = '".DatabaseManager::correctString($res_searx_version)."', ".
+            "`RETURN_CODE` = '".(int)$res_http_code."', ".
             "`LAST_UPDATE` = '".date('Y-m-d H:i:s',$res_timestamp)."' ".
-            "WHERE `#instances`.`ID` =".$single_instance['id'].";";
+            "WHERE `#instances`.`ID` =".(int)$single_instance['id'].";";
         $DatabaseHandler->query($query);
 
         // print result
@@ -174,7 +174,7 @@ if((bool)$config["engines"]["cronjob"] == True && $config["engines"]["server"] !
         $query = "UPDATE `#engines` SET ".
             "`IS_WORKING` = '".(int)$res_success."', ".
             "`LAST_UPDATE` = '".date('Y-m-d H:i:s',$res_timestamp)."' ".
-            "WHERE `#engines`.`ID` =".$single_engine['id'].";";
+            "WHERE `#engines`.`ID` =".(int)$single_engine['id'].";";
         $DatabaseHandler->query($query);
         
         if($res_success)

programming_language: PHP
CVE-2014-9626 (published 2020-01-24T22:15Z)

Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://github.com/videolan/vlc
commit_details: repo_url: https://github.com/videolan/vlc
author: Fabian Yamaguchi
author_date: 2014-12-05 13:52:42+01:00
msg: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
repository: repo_url: https://github.com/videolan/vlc
repo_name: videolan/vlc
description: VLC media player - All pull requests are ignored, please use MRs on https://code.videolan.org/videolan/vlc
repo_language: C
owner: videolan
file_changes: filename: libmp4.c
change_type: ModificationType.MODIFY
diff: @@ -2858,6 +2858,9 @@ static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );

programming_language: C
CVE-2021-40524 (published 2021-09-05T19:15Z)

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/jedisct1/pure-ftpd
commit_details: repo_url: https://github.com/jedisct1/pure-ftpd
author: Frank Denis
author_date: 2021-11-23 18:53:34+01:00
msg: Initialize the max upload file size when quotas are enabled

Due to an unwanted check, files causing the quota to be exceeded
were deleted after the upload, but not during the upload.

The bug was introduced in 2009 in version 1.0.23

Spotted by @DroidTest, thanks!
repository: repo_url: https://github.com/jedisct1/pure-ftpd
repo_name: jedisct1/pure-ftpd
description: Pure FTP server
repo_language: C
owner: jedisct1
file_changes: filename: ftpd.c
change_type: ModificationType.MODIFY
diff: @@ -4247,8 +4247,7 @@ void dostor(char *name, const int append, const int autorename)
     if (quota_update(&quota, 0LL, 0LL, &overflow) == 0 &&
         (overflow > 0 || quota.files >= user_quota_files ||
          quota.size > user_quota_size ||
-         (max_filesize >= (off_t) 0 &&
-          (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {
+         (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {
         overflow = 1;
         (void) close(f);
         goto afterquota;

programming_language: C
CVE-2022-2946 (published 2022-08-23T17:15Z)

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-08-22 16:35:45+01:00
msg: patch 9.0.0246: using freed memory when 'tagfunc' deletes the buffer

Problem:    Using freed memory when 'tagfunc' deletes the buffer.
Solution:   Make a copy of the tag name.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: tag.c
change_type: ModificationType.MODIFY
diff: @@ -281,6 +281,7 @@ do_tag(
     char_u	*buf_ffname = curbuf->b_ffname;	    // name to use for
 						    // priority computation
     int		use_tfu = 1;
+    char_u	*tofree = NULL;
 
     // remember the matches for the last used tag
     static int		num_matches = 0;
@@ -630,7 +631,12 @@ do_tag(
 	 * When desired match not found yet, try to find it (and others).
 	 */
 	if (use_tagstack)
-	    name = tagstack[tagstackidx].tagname;
+	{
+	    // make a copy, the tagstack may change in 'tagfunc'
+	    name = vim_strsave(tagstack[tagstackidx].tagname);
+	    vim_free(tofree);
+	    tofree = name;
+	}
 #if defined(FEAT_QUICKFIX)
 	else if (g_do_tagpreview != 0)
 	    name = ptag_entry.tagname;
@@ -922,6 +928,7 @@ end_do_tag:
     g_do_tagpreview = 0;	// don't do tag preview next time
 # endif
 
+    vim_free(tofree);
 #ifdef FEAT_CSCOPE
     return jumped_to_tag;
 #else

programming_language: C
filename: test_tagfunc.vim
change_type: ModificationType.MODIFY
diff: @@ -389,4 +389,16 @@ func Test_tagfunc_callback()
   %bw!
 endfunc
 
+func Test_tagfunc_wipes_buffer()
+  func g:Tag0unc0(t,f,o)
+   bwipe
+  endfunc
+  set tagfunc=g:Tag0unc0
+  new
+  cal assert_fails('tag 0', 'E987:')
+
+  delfunc g:Tag0unc0
+  set tagfunc=
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    246,
 /**/
     245,
 /**/

programming_language: Ruby
CVE-2022-35411 (published 2022-07-08T19:15Z)

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-522
cwe_name: Insufficiently Protected Credentials
description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/abersheeran/rpc.py
commit_details: repo_url: https://github.com/abersheeran/rpc.py
author: Aber
author_date: 2022-07-06 12:55:59+08:00
msg: PickleSerializer is turned off by default
repository: repo_url: https://github.com/abersheeran/rpc.py
repo_name: abersheeran/rpc.py
description: A fast and powerful RPC framework based on ASGI/WSGI.
repo_language: Python
owner: abersheeran
file_changes: filename: serializers.py
change_type: ModificationType.MODIFY
diff: @@ -108,16 +108,21 @@ class CBORSerializer(BaseSerializer):
         return cbor.loads(data)
 
 
+# Since the release of pickle to the external network may lead to
+# arbitrary code execution vulnerabilities, this serialization
+# method is not enabled by default. It is recommended to turn it on
+# when there is physical isolation from the outside.
+
 SERIALIZER_NAMES = {
     JSONSerializer.name: JSONSerializer(),
-    PickleSerializer.name: PickleSerializer(),
+    # PickleSerializer.name: PickleSerializer(),
     MsgpackSerializer.name: MsgpackSerializer(),
     CBORSerializer.name: CBORSerializer(),
 }
 
 SERIALIZER_TYPES = {
     JSONSerializer.content_type: JSONSerializer(),
-    PickleSerializer.content_type: PickleSerializer(),
+    # PickleSerializer.content_type: PickleSerializer(),
     MsgpackSerializer.content_type: MsgpackSerializer(),
     CBORSerializer.content_type: CBORSerializer(),
 }

programming_language: Python
CVE-2019-9734 (published 2019-04-24T15:29Z)

Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain circumstances.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/aquaverde/aquarius-core
commit_details: repo_url: https://github.com/aquaverde/aquarius-core
author: Tryption
author_date: 2019-03-15 21:00:06+01:00
msg: Fix CVE-2019-9734
repository: repo_url: https://github.com/aquaverde/aquarius-core
repo_name: aquaverde/aquarius-core
description: aquarius CMS 
repo_language: PHP
owner: aquaverde
file_changes: filename: log.php
change_type: ModificationType.MODIFY
diff: @@ -166,13 +166,11 @@ class Logger {
             if ($msg instanceof Exception || $msg instanceof Error) {
                 $excmessage = method_exists($msg, 'getDetailMessage') ? $msg->getDetailMessage() : $msg->getMessage();
                 $logmessage = $leveltext.": ".$excmessage."\n".Log::prettybacktrace($msg->getTrace());
-                $showrequest = true;
             } else {
                 $logmessage = $leveltext.": ". print_r($msg,true)."\n";
                 // Generate a backtrace if it was requested or in severe cases
                 if ($level == Log::BACKTRACE || $level >= Log::FAIL) {
                     $backtrace = "\n".Log::prettybacktrace();
-                    $showrequest = true;
                 }
             }
 

programming_language: PHP
CVE-2024-32964 (published 2024-05-14T15:37Z)

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/lobehub/lobe-chat
commit_details: repo_url: https://github.com/lobehub/lobe-chat
author: Arvin Xu
author_date: 2024-04-28 17:03:58+08:00
msg: 🐛 fix: fix `/api/proxy` internal proxy attack (#2255)
repository: repo_url: https://github.com/lobehub/lobe-chat
repo_name: lobehub/lobe-chat
description: 🤯 Lobe Chat - an open-source, modern-design LLMs/AI chat framework. Supports Multi AI Providers( OpenAI / Claude 3 / Gemini / Ollama / Bedrock / Azure / Mistral / Perplexity ), Multi-Modals (Vision/TTS) and plugin system. One-click FREE deployment of your private ChatGPT chat application.
repo_language: TypeScript
owner: lobehub
file_changes: filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -118,6 +118,7 @@
     "i18next-resources-to-backend": "^1.2.1",
     "idb-keyval": "^6.2.1",
     "immer": "^10.0.4",
+    "ip": "^2.0.1",
     "jose": "^5.2.4",
     "langfuse": "^3.7.0",
     "langfuse-core": "^3.7.0",
@@ -183,6 +184,7 @@
     "@types/chroma-js": "^2.4.4",
     "@types/debug": "^4.1.12",
     "@types/diff": "^5.2.0",
+    "@types/ip": "^1.1.3",
     "@types/json-schema": "^7.0.15",
     "@types/lodash": "^4.17.0",
     "@types/lodash-es": "^4.17.12",

programming_language: CoffeeScript
filename: route.ts
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,34 @@
-export const runtime = 'edge';
+import { isPrivate } from 'ip';
+import { NextResponse } from 'next/server';
+import dns from 'node:dns';
+import { promisify } from 'node:util';
+
+const lookupAsync = promisify(dns.lookup);
+
+export const runtime = 'nodejs';
 
 /**
  * just for a proxy
  */
 export const POST = async (req: Request) => {
-  const url = await req.text();
+  const url = new URL(await req.text());
+  let address;
+
+  try {
+    const lookupResult = await lookupAsync(url.hostname);
+    address = lookupResult.address;
+  } catch (err) {
+    console.error(`${url.hostname} DNS parser error:`, err);
+
+    return NextResponse.json({ error: 'DNS parser error' }, { status: 504 });
+  }
+
+  const isInternalHost = isPrivate(address);
+
+  if (isInternalHost)
+    return NextResponse.json({ error: 'Not support internal host proxy' }, { status: 400 });
 
-  const res = await fetch(url);
+  const res = await fetch(url.toString());
 
   return new Response(res.body, { headers: res.headers });
 };

programming_language: TypeScript