starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-10129 (published 2024-02-04T05:15Z)

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.

CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/samwilson/planet-freo
commit_details: repo_url: https://github.com/samwilson/planet-freo
author: nashe
author_date: 2015-08-03 18:51:51+02:00
msg: Avoid type juggling vulnerability.

Password comparison should not be done with the `==` operator, but
`===`, due to type juggling.

References:

* http://phpsadness.com/sad/47
*
turbochaos.blogspot.fr/2013/08/exploiting-exotic-bugs-php-type-juggling.
html

### Test case

* Create an administrator with the password "240610708".
* Try to login to the dashboard with the password "QNKCDZO" :-)
repository: repo_url: https://github.com/samwilson/planet-freo
repo_name: samwilson/planet-freo
description: The source for the Planet Freo blog aggregator.
repo_language: PHP
owner: samwilson
file_changes: filename: auth.inc.php
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,11 @@
 <?php
 include (dirname(__FILE__).'/pwd.inc.php');
 
-if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] == $password ) {
+if ( isset($_COOKIE['auth']) && $_COOKIE['auth'] === $password ) {
     //ok, cool
 } else {
     setcookie('auth','', time()-3600);
     header('Location: login.php');
     die;
 }
-?>
\ No newline at end of file
+?>

programming_language: PHP
CVE-2019-14981 (published 2019-08-12T23:15Z)

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-04-18 19:55:44-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1552
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: feature.c
change_type: ModificationType.MODIFY
diff: @@ -2313,7 +2313,7 @@ MagickExport Image *MeanShiftImage(const Image *image,const size_t width,
               }
           }
         }
-        gamma=1.0/count;
+        gamma=PerceptibleReciprocal(count);
         mean_location.x=gamma*sum_location.x;
         mean_location.y=gamma*sum_location.y;
         mean_pixel.red=gamma*sum_pixel.red;

programming_language: C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-04-18 19:55:30-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1552
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: feature.c
change_type: ModificationType.MODIFY
diff: @@ -2288,7 +2288,7 @@ MagickExport Image *MeanShiftImage(const Image *image,const size_t width,
               }
           }
         }
-        gamma=1.0/count;
+        gamma=PerceptibleReciprocal(count);
         mean_location.x=gamma*sum_location.x;
         mean_location.y=gamma*sum_location.y;
         mean_pixel.red=gamma*sum_pixel.red;

programming_language: Objective-C
CVE-2022-2553 (published 2022-07-28T15:15Z)

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/ClusterLabs/booth
commit_details: repo_url: https://github.com/ClusterLabs/booth
author: Jan Friesse
author_date: 2022-07-04 09:39:47+02:00
msg: Revert "Refactor: main: substitute is_auth_req macro"

This reverts commit da79b8ba28ad4837a0fee13e5f8fb6f89fe0e24c.

authfile != authkey

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
repository: repo_url: https://github.com/ClusterLabs/booth
repo_name: ClusterLabs/booth
description: The Booth Cluster Ticket Manager
repo_language: C
owner: ClusterLabs
file_changes: filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -364,7 +364,7 @@ static int setup_config(int type)
 	if (rv < 0)
 		goto out;
 
-	if (is_auth_req()) {
+	if (booth_conf->authfile[0] != '\0') {
 		rv = read_authkey();
 		if (rv < 0)
 			goto out;

programming_language: C
CVE-2022-0829 (published 2022-03-02T12:15Z)

Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Jamie Cameron
author_date: 2022-02-19 13:10:36-08:00
msg: Add missing permissions check when saving allowed cron users
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: save_allow.cgi
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@
 
 require './cron-lib.pl';
 &ReadParse();
+$access{'allow'} || &error($text{'allow_ecannot'});
 
 &lock_file($config{cron_allow_file});
 &lock_file($config{cron_deny_file});

programming_language: Perl
CVE-2021-43845 (published 2021-12-27T18:15Z)

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/pjsip/pjproject
commit_details: repo_url: https://github.com/pjsip/pjproject
author: Riza Sulistyo
author_date: 2021-12-24 11:17:15+07:00
msg: Merge pull request from GHSA-r374-qrwv-86hh
repository: repo_url: https://github.com/pjsip/pjproject
repo_name: pjsip/pjproject
description: PJSIP project
repo_language: C
owner: pjsip
file_changes: filename: rtcp_xr.c
change_type: ModificationType.MODIFY
diff: @@ -436,16 +436,32 @@ void pjmedia_rtcp_xr_rx_rtcp_xr( pjmedia_rtcp_xr_session *sess,
 	if (rb_len) {
 	    switch (rb_hdr->bt) {
 		case BT_RR_TIME:
-		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <=
+			(char*)pkt + size) 
+		    {
+			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr;
+		    }
 		    break;
 		case BT_DLRR:
-		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <=
+			(char*)pkt + size)
+		    {
+			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr;
+		    }
 		    break;
 		case BT_STATS:
-		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_stats) <=
+			(char*)pkt + size)
+		    {
+			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr;
+		    }
 		    break;
 		case BT_VOIP_METRICS:
-		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <=
+			(char*)pkt + size)
+		    {
+			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr;
+		    }
 		    break;
 		default:
 		    break;

programming_language: C
CVE-2017-2599 (published 2018-04-11T16:29Z)

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Jesse Glick
author_date: 2017-01-04 10:01:53-05:00
msg: Merge pull request #90 from jenkinsci-cert/SECURITY-321

[SECURITY-321] Prevent existing items from being overwritten even if you cannot DISCOVER them
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
CVE-2018-13305 (published 2018-07-05T17:29Z)

In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2018-06-28 23:46:32+02:00
msg: avcodec/vc1_block: Fix mqaunt check for negative values

Fixes: out of array access
Fixes: ffmpeg_bof_4.avi
Fixes: ffmpeg_bof_5.avi
Fixes: ffmpeg_bof_6.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Reviewed-by: Jerome Borsboom <jerome.borsboom@carpalis.nl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: vc1_block.c
change_type: ModificationType.MODIFY
diff: @@ -207,7 +207,7 @@ static void vc1_put_blocks_clamped(VC1Context *v, int put_signed)
         if ((edges&8) &&                                       \
             s->mb_y == ((s->mb_height >> v->field_mode) - 1))  \
             mquant = -v->altpq;                                \
-        if (!mquant || mquant > 31) {                          \
+        if (!mquant || mquant > 31 || mquant < -31) {                          \
             av_log(v->s.avctx, AV_LOG_ERROR,                   \
                    "Overriding invalid mquant %d\n", mquant);  \
             mquant = 1;                                        \

programming_language: C
CVE-2016-1709 (published 2016-07-23T19:59Z)

Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/googlei18n/sfntly
commit_details: repo_url: https://github.com/googlei18n/sfntly
author: Behdad Esfahbod
author_date: 2016-06-10 15:47:52-07:00
msg: Merge pull request #56 from leizleiz/bytearray

Add a bounds check to ByteArray::Get().
repository: repo_url: https://github.com/googlei18n/sfntly
repo_name: googlefonts/sfntly
description: A Library for Using, Editing, and Creating SFNT-based Fonts
repo_language: Java
owner: googlei18n
repo_url: https://github.com/googlei18n/sfntly
commit_details: repo_url: https://github.com/googlei18n/sfntly
author: Lei Zhang
author_date: 2016-06-09 23:30:26-07:00
msg: Add a bounds check to ByteArray::Get().
repository: repo_url: https://github.com/googlei18n/sfntly
repo_name: googlefonts/sfntly
description: A Library for Using, Editing, and Creating SFNT-based Fonts
repo_language: Java
owner: googlei18n
file_changes: filename: byte_array.cc
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ int32_t ByteArray::SetFilledLength(int32_t filled_length) {
 }
 
 int32_t ByteArray::Get(int32_t index) {
+  if (index < 0 || index >= Length())
+    return -1;
   return InternalGet(index) & 0xff;
 }
 

programming_language: C++
CVE-2020-11529 (published 2020-04-04T19:15Z)

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/getgrav/grav
commit_details: repo_url: https://github.com/getgrav/grav
author: Andy Miller
author_date: 2020-03-18 17:32:46-06:00
msg: Fix for user reported CVE path-based open redirect
repository: repo_url: https://github.com/getgrav/grav
repo_name: getgrav/grav
description: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
repo_language: PHP
owner: getgrav
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,7 @@
     * Moved `Parsedown` 1.6 and `ParsedownExtra` 0.7 into `Grav\Framework\Parsedown` to allow fixes
 1. [](#bugfix)
     * Fixed PHP 7.4 issue in ParsedownExtra [#2832](https://github.com/getgrav/grav/issues/2832)
+    * Fix for [user reported](https://twitter.com/OriginalSicksec) CVE path-based open redirect
 
 # v1.6.22
 ## 03/05/2020

programming_language: Markdown
filename: Grav.php
change_type: ModificationType.MODIFY
diff: @@ -316,7 +316,10 @@ class Grav extends Container
         /** @var Uri $uri */
         $uri = $this['uri'];
 
-        //Check for code in route
+        // Clean route for redirect
+        $route = preg_replace("#^\/[\\\/]+\/#", '/', $route);
+
+         // Check for code in route
         $regex = '/.*(\[(30[1-7])\])$/';
         preg_match($regex, $route, $matches);
         if ($matches) {

programming_language: PHP
CVE-2023-28883 (published 2023-03-27T03:15Z)

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/cerebrate-project/cerebrate
commit_details: repo_url: https://github.com/cerebrate-project/cerebrate
author: Sami Mokaddem
author_date: 2023-03-25 09:23:45+01:00
msg: fix: [security] blind SQL injection in searchAll

- As reported by Zigrin Security
repository: repo_url: https://github.com/cerebrate-project/cerebrate
repo_name: cerebrate-project/cerebrate
description: Cerebrate is an open-source platform meant to act as a trusted contact information provider and interconnection orchestrator for other security tools.
repo_language: PHP
owner: cerebrate-project
file_changes: filename: InstanceController.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,7 @@ class InstanceController extends AppController
         $searchValue = $this->request->getQuery('search');
         $model = $this->request->getQuery('model', null);
         $limit = $this->request->getQuery('limit', 5);
+        $limit = is_numeric($limit) ? $limit : 5;
         if (!empty($this->request->getQuery('show_all', false))) {
             $limit = null;
         }

programming_language: PHP
filename: InstanceTable.php
change_type: ModificationType.MODIFY
diff: @@ -81,7 +81,7 @@ class InstanceTable extends AppTable
         return $statistics;
     }
 
-    public function searchAll($value, $user, $limit=5, $model=null)
+    public function searchAll($value, $user, int $limit=5, $model=null)
     {
         $results = [];
         $models = $this->seachAllTables;

programming_language: PHP